CVE-2023-32762

An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transpo...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2023-32762 qt6-base Corrigé dans: 6.4.2+dfsg-9
Ubuntu UBUNTU-CVE-2023-32762 qtbase-opensource-src-gles

Références

advisory github.com
advisory nvd.nist.gov
patch github.com
web codereview.qt-project.org
web lists.qt-project.org
web lists.debian.org