Lucene search

K
mageiaGentoo FoundationMGASA-2017-0079
HistoryMar 23, 2017 - 10:19 a.m.

Updated kdelibs4 packages fix security vulnerability

2017-03-2310:19:23
Gentoo Foundation
advisories.mageia.org
13

0.003 Low

EPSS

Percentile

70.2%

Using a malicious PAC file, and then using exfiltration methods in the PAC function FindProxyForURL() enables the attacker to expose full https URLs. This is a security issue since https URLs may contain sensitive information in the URL authentication part (user:password@host), and in the path and the query (e.g. access tokens). This attack can be carried out remotely (over the LAN) since proxy settings allow โ€œDetect Proxy Configuration Automaticallyโ€. This setting uses WPAD to retrieve the PAC file, and an attacker who has access to the victimโ€™s LAN can interfere with the WPAD protocols (DHCP/DNS+HTTP) and inject his/her own malicious PAC instead of the legitimate one

OSVersionArchitecturePackageVersionFilename
Mageia5noarchkdelibs4<ย 4.14.30-1kdelibs4-4.14.30-1.mga5