Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 4 Jan 2013 11:16:19 -0500 (EST)
From: Jan Lieskovsky <jlieskov@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
        Rex Dieter <rdieter@...h.unl.edu>
Subject: CVE Request -- qt: QSslSocket might report inappropriate errors
 when certificate verification fails

Hello Kurt, Steve, vendors,

  Qt upstream has recently announced (upcoming) availability of 
Qt 4.8.5, Qt 4.7.6 and Qt 4.6.5 which (between other things) should
correct also the following security flaw:

A security flaw was found in the way QSslSocket implementation of the Qt,
a software toolkit for applications development, performed certificate
verification callbacks, when Qt libraries were used with different OpenSSL
version than the one, they were compiled against. In such scenario, this
would result in a connection error, but with the SSL error list to contain
QSslError:NoError instead of proper reason of the error. This might result
in a confusing error being presented to the end users, possibly encouraging
them to ignore the SSL errors for the site the connection was initiated against.

References:
[1] http://lists.qt-project.org/pipermail/announce/2013-January/000020.html
[2] https://bugzilla.redhat.com/show_bug.cgi?id=891955

Relevant upstream patch:
[3] https://codereview.qt-project.org/#change,42461

Could you allocate a CVE id for this?

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ