CVE-2023-34410: Medium severity F5 BIG-IP (APM, SSL Orchestrator) vulnerability
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does not always consider whether the root of a chain is a configured CA certificate.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Qtto a version that resolves this vulnerability.Fixed in 5.15.15 - Upgrade
Upgrade
Qt 6.xto a version that resolves this vulnerability.Fixed in 6.2.9 - Upgrade
Upgrade
Qt 6.3.x through 6.5.xto a version that resolves this vulnerability.Fixed in 6.5.2
Event History
Frequently Asked Questions
What is the severity of CVE-2023-34410?
The severity of CVE-2023-34410 is medium with a CVSS score of 5.3.
How does CVE-2023-34410 affect Qt?
CVE-2023-34410 affects Qt versions before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2.
What is the issue in CVE-2023-34410?
The issue in CVE-2023-34410 is that certificate validation for TLS does not always consider whether the root of a chain is a configured CA certificate.
How can I fix CVE-2023-34410?
To fix CVE-2023-34410, update to Qt version 5.15.15 or later, 6.2.9 or later, or 6.5.2 or later.
What is the Common Weakness Enumeration (CWE) for CVE-2023-34410?
The CWE for CVE-2023-34410 is CWE-295 (Improper Certificate Validation).