Lucene search

PRIOn knowledge basePRION:CVE-2023-32762

HistoryMay 28, 2023 - 11:15 p.m.

Design/Logic Flaw

2023-05-2823:15:00

PRIOn knowledge base

www.prio-n.com

design/logic flaw

network

hsts

unencrypted connections

server restriction

5.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

37.4%

JSON

An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match.

CPENameOperatorVersion
qtge6.3.0
qtlt6.5.1
qtge6.0.0
qtlt6.2.9
qtlt5.15.14

Name	Operator	Version
qt	ge	6.3.0
qt	lt	6.5.1
qt	ge	6.0.0
qt	lt	6.2.9
qt	lt	5.15.14

References

codereview.qt-project.org/c/qt/qtbase/+/476140

github.com/qt/qtbase/commit/1b736a815be0222f4b24289cf17575fc15707305

lists.qt-project.org/pipermail/announce/2023-May/000414.html