Qt up to 5.15.14/6.2.8/6.5.1 TLS certificate validation

Summaryinfo

A vulnerability, which was classified as critical, has been found in Qt up to 5.15.14/6.2.8/6.5.1. This impacts an unknown function of the component TLS Handler. Performing a manipulation results in certificate validation. This vulnerability is cataloged as CVE-2023-34410. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Qt up to 5.15.14/6.2.8/6.5.1. This affects an unknown functionality of the component TLS Handler. The manipulation with an unknown input leads to a certificate validation vulnerability. CWE is classifying the issue as CWE-295. The product does not validate, or incorrectly validates, a certificate. This is going to have an impact on confidentiality. The summary by CVE is:

An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does not always consider whether the root of a chain is a configured CA certificate.

The weakness was shared 06/05/2023. It is possible to read the advisory at codereview.qt-project.org. This vulnerability is uniquely identified as CVE-2023-34410 since 06/05/2023. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1587.003 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 211880 (F5 Networks BIG-IP : Qt vulnerability (K000148692)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.15.15, 6.2.9 or 6.5.2 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (211880) and EUVD (EUVD-2023-38488). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Qt

Version

• 5.15.0
• 5.15.1
• 5.15.2
• 5.15.3
• 5.15.4
• 5.15.5
• 5.15.6
• 5.15.7
• 5.15.8
• 5.15.9
• 5.15.10
• 5.15.11
• 5.15.12
• 5.15.13
• 5.15.14
• 6.2.0
• 6.2.1
• 6.2.2
• 6.2.3
• 6.2.4
• 6.2.5
• 6.2.6
• 6.2.7
• 6.2.8
• 6.5.0
• 6.5.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion