Lucene search

K
freebsdFreeBSDF5FA174D-19DE-11EF-83D8-4CCC6ADDA413
HistoryMay 08, 2024 - 12:00 a.m.

QtNetworkAuth -- predictable seeding of PRNG in QAbstractOAuth

2024-05-0800:00:00
vuxml.freebsd.org
6
qtnetworkauth
oauth1
prng
vulnerability
seeding
predictable
nonce
attacker
control
time

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.6%

Andy Shaw reports:

The OAuth1 implementation in QtNetworkAuth created nonces using
a PRNG that was seeded with a predictable seed.
This means that an attacker that can somehow control the time of
the first OAuth1 flow of the process has a high chance of predicting
the nonce used in said OAuth flow.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchqt5-networkauth< 5.15.13_1UNKNOWN
FreeBSDanynoarchqt6-networkauth< 6.7.1UNKNOWN

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.6%

Related for F5FA174D-19DE-11EF-83D8-4CCC6ADDA413