In qutebrowser versions less than 1.11.1, reloading a page with certificate errors shows a green URL. After a certificate error was overridden by the user, qutebrowser displays the URL as yellow (colors.statusbar.url.warn.fg). However, when the affected website was subsequently loaded again, the URL was mistakenly displayed as green (colors.statusbar.url.success_https). While the user already has seen a certificate error prompt at this point (or set content.ssl_strict to false, which is not recommended), this could still provide a false sense of security. This has been fixed in 1.11.1 and 1.12.0. All versions of qutebrowser are believed to be affected, though versions before v0.11.x couldn't be tested. Backported patches for older versions (greater than or equal to 1.4.0 and less than or equal to 1.10.2) are available, but no further releases are planned.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In qutebrowser versions less than 1.11.1, reloading a page with certificate errors shows a green URL.
    After a certificate error was overridden by the user, qutebrowser displays the URL as yellow     (colors.statusbar.url.warn.fg). However, when the affected website was subsequently loaded again, the URL     was mistakenly displayed as green (colors.statusbar.url.success_https). While the user already has seen a     certificate error prompt at this point (or set content.ssl_strict to false, which is not recommended),     this could still provide a false sense of security. This has been fixed in 1.11.1 and 1.12.0. All versions     of qutebrowser are believed to be affected, though versions before v0.11.x couldn't be tested. Backported     patches for older versions (greater than or equal to 1.4.0 and less than or equal to 1.10.2) are     available, but no further releases are planned. (CVE-2020-11054)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In qutebrowser versions less than 1.11.1, reloading a page with certificate errors shows a green URL.
    After a certificate error was overridden by the user, qutebrowser displays the URL as yellow
    (colors.statusbar.url.warn.fg). However, when the affected website was subsequently loaded again, the URL
    was mistakenly displayed as green (colors.statusbar.url.success_https). While the user already has seen a
    certificate error prompt at this point (or set content.ssl_strict to false, which is not recommended),
    this could still provide a false sense of security. This has been fixed in 1.11.1 and 1.12.0. All versions
    of qutebrowser are believed to be affected, though versions before v0.11.x couldn't be tested. Backported
    patches for older versions (greater than or equal to 1.4.0 and less than or equal to 1.10.2) are
    available, but no further releases are planned. (CVE-2020-11054)

We missed a few upstream releases but there's not breaking changes as far as I know. Lot of bug fixes and minor changes.

----

Addresses CVE-2020-11054: After a certificate error was overridden by the user, qutebrowser displays the URL as yellow (colors.statusbar.url.warn.fg). However, when the affected website was subsequently loaded again, the URL was mistakenly displayed as green (colors.statusbar.url.success_https). While the user already has seen a certificate error prompt at this point (or set content.ssl_strict to false which is not recommended), this could still provide a false sense of security. This is now fixed.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Qutebrowser developers report :

After a certificate error was overridden by the user, qutebrowser displays the URL as yellow (colors.statusbar.url.warn.fg). However, when the affected website was subsequently loaded again, the URL was mistakenly displayed as green (colors.statusbar.url.success_https).
While the user already has seen a certificate error prompt at this point (or set content.ssl_strict to false which is not recommended), this could still provide a false sense of security.

ID	Name	Product	Family	Severity
250637	Linux Distros Unpatched Vulnerability : CVE-2020-11054	Nessus	Misc.	low
423573	SCA: security update for qutebrowser (GHSA-4rcq-jv2f-898j)	Tenable Cloud Security	SCA Checks	low
423573	SCA: security update for qutebrowser (GHSA-4rcq-jv2f-898j)	Tenable Self-Hosted Container Security	SCA Checks	low
140676	Fedora 32 : qutebrowser (2020-f0812d6aad)	Nessus	Fedora Local Security Checks	low
136442	FreeBSD : qutebrowser -- Reloading page with certificate errors shows a green URL (452d16bb-920d-11ea-9d20-18a6f7016652)	Nessus	FreeBSD Local Security Checks	low

Detections

Analytics

CVE-2020-11054

low

Tenable Plugins

low

low

low

low

low