Date: Tue, 03 Aug 2021 19:48:45 -0400 From: "Alex Xu (Hello71)" <alex_y_xu@...oo.ca> To: oss-security@...ts.openwall.com Subject: Reminder: QtWebKit known vulnerabilities Quoting Christophe Giboudeaux  (excerpted, rewrapped), > QtWebKit was a rendering engine for web content released with Qt until > 5.6. It was replaced with QtWebEngine after that. > > Despite a community fork in 2016, nothing really happened to keep it > alive and secure. > Quoting the QtWebKit release page on Github: > > "WARNING: This release is based on old WebKit revision with known > unpatched vulnerabilities. > Please use it carefully and avoid visiting untrusted websites and > using it for transmission of sensitive data." As of today, Repology reports that 246 packages still exist for qt5-webkit, in dozens of Linux distros (most of them overcounted, e.g. qt5-qtwebkit-dev). Of particular concern is the 104 packages known for wkhtmltopdf. As repeated multiple times on the website (unfortunately not prominently enough), "Do not use wkhtmltopdf with any untrusted HTML". However, it's fair to say that many users likely do not follow this advice. Readers of this list will likely be familiar with the regular postings regarding WebKitGTK vulnerabilities: many of them are likely applicable to QtWebKit too, especially the WebKitGTK-based fork. Fortunately, as opposed to the webkitgtk issues a few years ago, most programs now support Qt WebEngine, QTextBrowser (part of Qt Widgets), or don't require any browser engine anymore. Almost all exceptions are no longer maintained upstream. wkhtmltopdf is likely the most used package that still requires QtWebKit, but in my opinion is the most dangerous, as users may unknowingly install it from distro repositories and use it to process untrusted data. Users can migrate to weasyprint, puppeteer, or another alternative. Alpine Linux has removed QtWebKit , Gentoo Linux has masked it  (meaning users must manually approve the installation), and OpenSUSE will be removing it soon . In the absence of a maintained QtWebKit, I urge other distros to follow suit to protect Linux users.  https://email@example.com/thread/GXVEFT7VY5DQNATX6FHJBQBRDHRC3NRN/  https://gitlab.alpinelinux.org/alpine/aports/-/issues/12888  https://bugs.gentoo.org/684580 Regards, Alex.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.