Vulnerability Details : CVE-2023-32762
An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match.
Products affected by CVE-2023-32762
- cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*
- cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*
- cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-32762
0.10%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 44 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-32762
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
3.9
|
1.4
|
134c704f-9b21-4f2e-91b3-4a467353bcc0 | 2024-08-19 |
|
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
3.9
|
1.4
|
NIST |
References for CVE-2023-32762
-
https://lists.qt-project.org/pipermail/announce/2023-May/000414.html
[Announce] Security advisory: Qt NetworkMailing List;Patch
-
https://github.com/qt/qtbase/commit/1b736a815be0222f4b24289cf17575fc15707305
Hsts: match header names case insensitively · qt/qtbase@1b736a8 · GitHubPatch
-
https://codereview.qt-project.org/c/qt/qtbase/+/476140
Hsts: match header names case insensitively (Ifb4def4b) · Gerrit Code ReviewPatch
-
https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
[SECURITY] [DLA 3805-1] qtbase-opensource-src security update
Jump to