REDHAT-BUG-891955: Low severity trolltech qt vulnerability
A security flaw was found in the way QSslSocket implementation of the Qt, a software toolkit for applications development, performed certificate verification callbacks, when Qt libraries were used with different OpenSSL version than the one, they were compiled against. In such scenario, this would result in a connection error, but with the SSL error list to contain QSslError:NoError instead of proper reason of the error. This might result in a confusing error being presented to the end users, possibly encouraging them to ignore the SSL errors for the site the connection was initiated against.
References: [1] http://lists.qt-project.org/pipermail/announce/2013-January/000020.html
Relevant upstream patch: [2] https://codereview.qt-project.org/#change,42461
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-891955?
The severity of REDHAT-BUG-891955 is considered high due to the potential for certificate verification issues leading to security risks.
How do I fix REDHAT-BUG-891955?
To fix REDHAT-BUG-891955, ensure that the Qt libraries are compiled with the same OpenSSL version being used at runtime.
What systems are affected by REDHAT-BUG-891955?
REDHAT-BUG-891955 affects systems utilizing Qt in conjunction with incompatible versions of OpenSSL.
What risks are associated with REDHAT-BUG-891955?
Risks associated with REDHAT-BUG-891955 include potential man-in-the-middle attacks due to improper certificate validation.
Is there a patch available for REDHAT-BUG-891955?
Yes, patches have been released to address REDHAT-BUG-891955 and should be applied as soon as possible.