qtwebsockets-opensource-src: CVE-2018-21035: QWebsocket large frame/message issue, denial of service

Debian Bug report logs - #953049
qtwebsockets-opensource-src: CVE-2018-21035: QWebsocket large frame/message issue, denial of service

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: qtwebsockets-opensource-src: CVE-2018-21035: QWebsocket large frame/message issue, denial of service

Date: Tue, 03 Mar 2020 20:57:01 +0100

Source: qtwebsockets-opensource-src
Version: 5.14.1-1
Severity: important
Tags: security upstream
Forwarded: https://bugreports.qt.io/browse/QTBUG-70693
Control: found -1 5.12.5-2
Control: found -1 5.11.3-5

Hi,

The following vulnerability was published for qtwebsockets-opensource-src.

CVE-2018-21035[0]:
| In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB
| for frames and 2GB for messages. Smaller limits cannot be configured.
| This makes it easier for attackers to cause a denial of service
| (memory consumption).


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-21035
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-21035
[1] https://bugreports.qt.io/browse/QTBUG-70693
[2] https://codereview.qt-project.org/c/qt/qtwebsockets/+/284735

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Send a report that this bug log contains spam.