REDHAT-BUG-961981
First published: Fri May 10 2013(Updated: )
It was reported [1] that when KDE encounters an "internal server error" and also prints out the URL that caused the error that it would include the username and password (if supplied) to the resource that caused the error. For instance, it would show "<a href="https://user:password@remotehost.com">https://user:password@remotehost.com</a>" or similar. This is due to kioslave/http/http.cpp using m_request.url.url() rather than the sanitized m_request.url.prettyUrl(). This issue is fixed in git [2]. Note that this information is printed out to the local user actively using the computer. [1] <a href="https://bugs.kde.org/show_bug.cgi?id=319428">https://bugs.kde.org/show_bug.cgi?id=319428</a> [2] <a href="https://projects.kde.org/projects/kde/kdelibs/repository/revisions/65d736dab592bced4410ccfa4699de89f78c96ca/diff/kioslave/http/http.cpp">https://projects.kde.org/projects/kde/kdelibs/repository/revisions/65d736dab592bced4410ccfa4699de89f78c96ca/diff/kioslave/http/http.cpp</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat kdelibs | <65d736dab592bced4410ccfa4699de89f78c96ca |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://user:password@remotehost.com
- https://bugs.kde.org/show_bug.cgi?id=319428
- https://projects.kde.org/projects/kde/kdelibs/repository/revisions/65d736dab592bced4410ccfa4699de89f78c96ca/diff/kioslave/http/http.cpp
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=961982
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=962001
- http://www.openwall.com/lists/oss-security/2013/05/11/2
- https://access.redhat.com/security/cve/CVE-2013-2074
- https://bugzilla.redhat.com/show_bug.cgi?id=961981
Frequently Asked Questions
What is the vulnerability ID for the issue where KDE exposes credentials during an internal server error?
The vulnerability ID for this issue is REDHAT-BUG-961981.
What are the affected software versions for REDHAT-BUG-961981?
The affected software version for REDHAT-BUG-961981 is KDE kdelibs versions prior to 65d736dab592bced4410ccfa4699de89f78c96ca.
What kind of information does the vulnerability REDHAT-BUG-961981 leak?
The vulnerability REDHAT-BUG-961981 leaks usernames and passwords in URLs when an internal server error occurs.
How can I mitigate the risks associated with vulnerability REDHAT-BUG-961981?
To mitigate the risks associated with REDHAT-BUG-961981, upgrade KDE kdelibs to a version after the affected commit.
Is there a known fix for vulnerability REDHAT-BUG-961981?
Yes, updating to a version of KDE kdelibs that is higher than 65d736dab592bced4410ccfa4699de89f78c96ca addresses the REDHAT-BUG-961981 vulnerability.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2013-2074
- agent/severity
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/kde
- canonical/red hat kdelibs