Detections
Analytics
SCA: security update for qutebrowser (GHSA-4rcq-jv2f-898j)
low Tenable Self-Hosted Container Security Plugin ID 423573
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- In qutebrowser versions less than 1.11.1, reloading a page with certificate errors shows a green URL.
After a certificate error was overridden by the user, qutebrowser displays the URL as yellow
(colors.statusbar.url.warn.fg). However, when the affected website was subsequently loaded again, the URL
was mistakenly displayed as green (colors.statusbar.url.success_https). While the user already has seen a
certificate error prompt at this point (or set content.ssl_strict to false, which is not recommended),
this could still provide a false sense of security. This has been fixed in 1.11.1 and 1.12.0. All versions
of qutebrowser are believed to be affected, though versions before v0.11.x couldn't be tested. Backported
patches for older versions (greater than or equal to 1.4.0 and less than or equal to 1.10.2) are
available, but no further releases are planned. (CVE-2020-11054)
See Also
Plugin Details
Severity: Low
ID: 423573
Version: Revision 1.7
Type: Local
Family: SCA Checks
Published: 3/29/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2020-11054
CVSS v3
Risk Factor: Low
Base Score: 3.5
Temporal Score: 3.1
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 5/8/2020
Vulnerability Publication Date: 5/7/2020
Reference Information
CVE: CVE-2020-11054
cwe: CWE-684