CVE-2023-32762

An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transpo...

Original description

The description as published by the source.

An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2023-32762 qt6-base Fixed in: 6.4.2+dfsg-9
Ubuntu UBUNTU-CVE-2023-32762 qtbase-opensource-src-gles

References

advisory github.com
advisory nvd.nist.gov
patch github.com
web codereview.qt-project.org
web lists.qt-project.org
web lists.debian.org