In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumption).

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4690 advisory.

  - Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is     mishandled in QXmlStreamReader, a related issue to CVE-2003-1564. (CVE-2015-9541)

  - In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages.
    Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service     (memory consumption). (CVE-2018-21035)

  - Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated     user to potentially enable denial of service via local access. (CVE-2020-0569)

  - Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated     user to potentially enable elevation of privilege via local access. (CVE-2020-0570)

  - Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles     OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in     unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails. (Mumble 1.3.1     is not affected, regardless of the Qt version.) (CVE-2020-13962)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4690 advisory.

  - Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is     mishandled in QXmlStreamReader, a related issue to CVE-2003-1564. (CVE-2015-9541)

  - In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages.
    Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service     (memory consumption). (CVE-2018-21035)

  - Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated     user to potentially enable denial of service via local access. (CVE-2020-0569)

  - Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated     user to potentially enable elevation of privilege via local access. (CVE-2020-0570)

  - Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles     OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in     unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails. (Mumble 1.3.1     is not affected, regardless of the Qt version.) (CVE-2020-13962)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has qt5-qtwebsockets packages installed that are affected by a vulnerability:

  - In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages.
    Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service     (memory consumption). (CVE-2018-21035)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4690 advisory.

  - qt: XML entity expansion vulnerability (CVE-2015-9541)

  - qt5-qtwebsockets: websocket implementation allows only limited size for frames and messages therefore     attacker can cause DOS (CVE-2018-21035)

  - qt: files placed by attacker can influence the working directory and lead to malicious code execution     (CVE-2020-0569, CVE-2020-0570)

  - qt5: incorrectly calls SSL_shutdown() in OpenSSL mid-handshake causing denial of service in TLS     applications (CVE-2020-13962)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4690 advisory.

  - Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is     mishandled in QXmlStreamReader, a related issue to CVE-2003-1564. (CVE-2015-9541)

  - In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages.
    Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service     (memory consumption). (CVE-2018-21035)

  - Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles     OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in     unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails. (Mumble 1.3.1     is not affected, regardless of the Qt version.) (CVE-2020-13962)

  - qt: files placed by attacker can influence the working directory and lead to malicious code execution     (CVE-2020-0569)

  - Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated     user to potentially enable elevation of privilege via local access. (CVE-2020-0570)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4690 advisory.

  - qt: XML entity expansion vulnerability (CVE-2015-9541)

  - qt5-qtwebsockets: websocket implementation allows only limited size for frames and messages therefore     attacker can cause DOS (CVE-2018-21035)

  - qt: files placed by attacker can influence the working directory and lead to malicious code execution     (CVE-2020-0569, CVE-2020-0570)

  - qt5: incorrectly calls SSL_shutdown() in OpenSSL mid-handshake causing denial of service in TLS     applications (CVE-2020-13962)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
184835	Rocky Linux 8 : qt5-qtbase and qt5-qtwebsockets (RLSA-2020:4690)	Nessus	Rocky Linux Local Security Checks	high
157637	AlmaLinux 8 : qt5-qtbase and qt5-qtwebsockets (ALSA-2020:4690)	Nessus	Alma Linux Local Security Checks	high
147358	NewStart CGSL MAIN 6.02 : qt5-qtwebsockets Vulnerability (NS-SA-2021-0085)	Nessus	NewStart CGSL Local Security Checks	high
146016	CentOS 8 : qt5-qtbase and qt5-qtwebsockets (CESA-2020:4690)	Nessus	CentOS Local Security Checks	high
142803	Oracle Linux 8 : qt5-qtbase / and / qt5-qtwebsockets (ELSA-2020-4690)	Nessus	Oracle Linux Local Security Checks	high
142445	RHEL 8 : qt5-qtbase and qt5-qtwebsockets (RHSA-2020:4690)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2018-21035

high

Tenable Plugins

high

high

high

high

high

high