Bug#856890: kde4libs: CVE-2017-6410: Information Leak when accessing https when using a malicious PAC file

[Salvatore Bonaccorso <carnil@debian.org>]

Source: kde4libs
Source-Version: 4:4.14.26-2

On Sun, Mar 05, 2017 at 09:48:06PM +0100, Salvatore Bonaccorso wrote:
> Source: kde4libs
> Version: 4:4.14.26-1
> Severity: important
> Tags: upstream patch security
> 
> Hi,
> 
> the following vulnerability was published for kde4libs.
> 
> CVE-2017-6410[0]:
> | kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls
> | the PAC FindProxyForURL function with a full https URL (potentially
> | including Basic Authentication credentials, a query string, or
> | PATH_INFO), which allows remote attackers to obtain sensitive
> | information via a crafted PAC file.
> 
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2017-6410
>     https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6410
> [1] https://commits.kde.org/kdelibs/1804c2fde7bf4e432c6cf5bb8cce5701c7010559
> [2] https://www.kde.org/info/security/advisory-20170228-1.txt

This was addressed in the last unstable upload with:

   * Apply "Sanitize URLs before passing them to FindProxyForURL" (1804c2f)
     Remove user/password information
     For https: remove path and query
     Backport from kio f9d0cb47cf94e209f6171ac0e8d774e68156a6e4

Regards,
Salvatore