diff options
| author | Jason E. Hale <jhale@FreeBSD.org> | 2024-05-25 01:30:05 +0000 |
|---|---|---|
| committer | Jason E. Hale <jhale@FreeBSD.org> | 2024-05-25 01:55:22 +0000 |
| commit | 1f5a0d033f3646f65dc16f1b53108cb32deff9b7 (patch) | |
| tree | 34c0d0d897b43eaa9258f95df48758fbf48c7df0 /security/vuxml | |
| parent | 48f4a9b7c9ba5e2fb1d48c08c438efa5fe2b5565 (diff) | |
| download | ports-1f5a0d033f3646f65dc16f1b53108cb32deff9b7.tar.gz ports-1f5a0d033f3646f65dc16f1b53108cb32deff9b7.zip | |
security/vuxml: Document CVE-2024-36048 for qt[56]-networkauth
Diffstat (limited to 'security/vuxml')
| -rw-r--r-- | security/vuxml/vuln/2024.xml | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml index b92bf14caa15..5a98f15f0b3d 100644 --- a/security/vuxml/vuln/2024.xml +++ b/security/vuxml/vuln/2024.xml @@ -1,3 +1,38 @@ + <vuln vid="f5fa174d-19de-11ef-83d8-4ccc6adda413"> + <topic>QtNetworkAuth -- predicatable seeding of PRNG in QAbstractOAuth</topic> + <affects> + <package> + <name>qt5-networkauth</name> + <range><lt>5.15.13_1</lt></range> + </package> + <package> + <name>qt6-networkauth</name> + <range><lt>6.7.1</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Andy Shaw reports:</p> + <blockquote cite="https://www.qt.io/blog/security-advisory-qstringconverter-0"> + <p>The OAuth1 implementation in QtNetworkAuth created nonces using + a PRNG that was seeded with a predictable seed.</p> + <p>This means that an attacker that can somehow control the time of + the first OAuth1 flow of the process has a high chance of predicting + the nonce used in said OAuth flow.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2024-36048</cvename> + <url>https://www.qt.io/blog/security-advisory-qstringconverter-0</url> + <url>https://codereview.qt-project.org/c/qt/qtnetworkauth/+/560317</url> + </references> + <dates> + <discovery>2024-05-08</discovery> + <entry>2024-05-24</entry> + </dates> + </vuln> + <vuln vid="f848ef90-1848-11ef-9850-001b217b3468"> <topic>Gitlab -- Vulnerabilities</topic> <affects> |