oss-sec mailing list archives
CVE Request -- qt: QSslSocket might report inappropriate errors when certificate verification fails
From: Jan Lieskovsky <jlieskov () redhat com>
Date: Fri, 4 Jan 2013 11:16:19 -0500 (EST)
Hello Kurt, Steve, vendors, Qt upstream has recently announced (upcoming) availability of Qt 4.8.5, Qt 4.7.6 and Qt 4.6.5 which (between other things) should correct also the following security flaw: A security flaw was found in the way QSslSocket implementation of the Qt, a software toolkit for applications development, performed certificate verification callbacks, when Qt libraries were used with different OpenSSL version than the one, they were compiled against. In such scenario, this would result in a connection error, but with the SSL error list to contain QSslError:NoError instead of proper reason of the error. This might result in a confusing error being presented to the end users, possibly encouraging them to ignore the SSL errors for the site the connection was initiated against. References: [1] http://lists.qt-project.org/pipermail/announce/2013-January/000020.html [2] https://bugzilla.redhat.com/show_bug.cgi?id=891955 Relevant upstream patch: [3] https://codereview.qt-project.org/#change,42461 Could you allocate a CVE id for this? Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Current thread:
- CVE Request -- qt: QSslSocket might report inappropriate errors when certificate verification fails Jan Lieskovsky (Jan 04)