EUVD-2020-17335

Malware in sbrugna...

Design/Logic Flaw

In mainwindow.cpp in Shotcut before 20.09.13, the upgrade check misuses TLS because of setPeerVerifyModeQSslSocket::VerifyNone. A man-in-the-middle attacker could offer a spoofed download resource...

CVE-2020-24619

CVE-2020-24619 affects Shotcut prior to 20.09.13, where an upgrade check misuses TLS via setPeerVerifyMode(QSslSocket::VerifyNone) in mainwindow.cpp. This enables a man-in-the-middle to offer a spoofed download resource. The Red Hat, Ubuntu, Ubuntu OSV, and other entries in the connected set corr...