Lucene search

K
amazonAmazonALAS-2024-2421
HistoryJan 19, 2024 - 1:51 a.m.

Medium: qt5-qtbase

2024-01-1901:51:00
alas.aws.amazon.com
10
network access http2
hpack integer overflow
update
amazon linux 2
aarch64
i686
noarch
source
x86_64
red hat
mitre
unix

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.3%

Issue Overview:

An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check. (CVE-2023-51714)

Affected Packages:

qt5-qtbase

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update qt5-qtbase to update your system.

New Packages:

aarch64:  
    qt5-qtbase-5.9.2-3.amzn2.0.13.aarch64  
    qt5-qtbase-devel-5.9.2-3.amzn2.0.13.aarch64  
    qt5-qtbase-doc-5.9.2-3.amzn2.0.13.aarch64  
    qt5-qtbase-examples-5.9.2-3.amzn2.0.13.aarch64  
    qt5-qtbase-static-5.9.2-3.amzn2.0.13.aarch64  
    qt5-qtbase-mysql-5.9.2-3.amzn2.0.13.aarch64  
    qt5-qtbase-odbc-5.9.2-3.amzn2.0.13.aarch64  
    qt5-qtbase-postgresql-5.9.2-3.amzn2.0.13.aarch64  
    qt5-qtbase-gui-5.9.2-3.amzn2.0.13.aarch64  
    qt5-qtbase-debuginfo-5.9.2-3.amzn2.0.13.aarch64  
  
i686:  
    qt5-qtbase-5.9.2-3.amzn2.0.13.i686  
    qt5-qtbase-devel-5.9.2-3.amzn2.0.13.i686  
    qt5-qtbase-doc-5.9.2-3.amzn2.0.13.i686  
    qt5-qtbase-examples-5.9.2-3.amzn2.0.13.i686  
    qt5-qtbase-static-5.9.2-3.amzn2.0.13.i686  
    qt5-qtbase-mysql-5.9.2-3.amzn2.0.13.i686  
    qt5-qtbase-odbc-5.9.2-3.amzn2.0.13.i686  
    qt5-qtbase-postgresql-5.9.2-3.amzn2.0.13.i686  
    qt5-qtbase-gui-5.9.2-3.amzn2.0.13.i686  
    qt5-qtbase-debuginfo-5.9.2-3.amzn2.0.13.i686  
  
noarch:  
    qt5-qtbase-common-5.9.2-3.amzn2.0.13.noarch  
    qt5-rpm-macros-5.9.2-3.amzn2.0.13.noarch  
  
src:  
    qt5-qtbase-5.9.2-3.amzn2.0.13.src  
  
x86_64:  
    qt5-qtbase-5.9.2-3.amzn2.0.13.x86_64  
    qt5-qtbase-devel-5.9.2-3.amzn2.0.13.x86_64  
    qt5-qtbase-doc-5.9.2-3.amzn2.0.13.x86_64  
    qt5-qtbase-examples-5.9.2-3.amzn2.0.13.x86_64  
    qt5-qtbase-static-5.9.2-3.amzn2.0.13.x86_64  
    qt5-qtbase-mysql-5.9.2-3.amzn2.0.13.x86_64  
    qt5-qtbase-odbc-5.9.2-3.amzn2.0.13.x86_64  
    qt5-qtbase-postgresql-5.9.2-3.amzn2.0.13.x86_64  
    qt5-qtbase-gui-5.9.2-3.amzn2.0.13.x86_64  
    qt5-qtbase-debuginfo-5.9.2-3.amzn2.0.13.x86_64  

Additional References

Red Hat: CVE-2023-51714

Mitre: CVE-2023-51714

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.3%