Bug#953049: qtwebsockets-opensource-src: CVE-2018-21035: QWebsocket large frame/message issue, denial of service
Source: qtwebsockets-opensource-src
Version: 5.14.1-1
Severity: important
Tags: security upstream
Forwarded: https://bugreports.qt.io/browse/QTBUG-70693
Control: found -1 5.12.5-2
Control: found -1 5.11.3-5
Hi,
The following vulnerability was published for qtwebsockets-opensource-src.
CVE-2018-21035[0]:
| In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB
| for frames and 2GB for messages. Smaller limits cannot be configured.
| This makes it easier for attackers to cause a denial of service
| (memory consumption).
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2018-21035
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-21035
[1] https://bugreports.qt.io/browse/QTBUG-70693
[2] https://codereview.qt-project.org/c/qt/qtwebsockets/+/284735
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
Reply to: