In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumption).

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - qt5-qtwebsockets: websocket implementation allows only limited size for frames and messages therefore     attacker can cause DOS (CVE-2018-21035)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4690 advisory.

  - Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is     mishandled in QXmlStreamReader, a related issue to CVE-2003-1564. (CVE-2015-9541)

  - In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages.
    Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service     (memory consumption). (CVE-2018-21035)

  - Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated     user to potentially enable denial of service via local access. (CVE-2020-0569)

  - Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated     user to potentially enable elevation of privilege via local access. (CVE-2020-0570)

  - Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles     OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in     unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails. (Mumble 1.3.1     is not affected, regardless of the Qt version.) (CVE-2020-13962)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4690 advisory.

  - Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is     mishandled in QXmlStreamReader, a related issue to CVE-2003-1564. (CVE-2015-9541)

  - In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages.
    Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service     (memory consumption). (CVE-2018-21035)

  - Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated     user to potentially enable denial of service via local access. (CVE-2020-0569)

  - Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated     user to potentially enable elevation of privilege via local access. (CVE-2020-0570)

  - Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles     OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in     unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails. (Mumble 1.3.1     is not affected, regardless of the Qt version.) (CVE-2020-13962)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has qt5-qtwebsockets packages installed that are affected by a vulnerability:

  - In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages.
    Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service     (memory consumption). (CVE-2018-21035)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4690 advisory.

  - qt: XML entity expansion vulnerability (CVE-2015-9541)

  - qt5-qtwebsockets: websocket implementation allows only limited size for frames and messages therefore     attacker can cause DOS (CVE-2018-21035)

  - qt: files placed by attacker can influence the working directory and lead to malicious code execution     (CVE-2020-0569, CVE-2020-0570)

  - qt5: incorrectly calls SSL_shutdown() in OpenSSL mid-handshake causing denial of service in TLS     applications (CVE-2020-13962)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4690 advisory.

    qt5-qtbase     [5.12.5-6]
    - OpenSSL: handle SSL_shutdowns errors properly       Resolves: bz#1851538

    [5.12.5-5]
    - Fix: Files placed by attacker can influence the working directory and lead to malicious code execution       Resolves: bz#1814739       Resolves: bz#1814683

    - Fix: XML entity expansion vulnerability       Resolves: bz#1822193

    qt5-qttools     [5.12.5-2]
    - Rebuild (LLVM-10)       Resolves: bz#1832857

    qt5-qtwebsockets     [5.12.5-2]
    - Add a public api to set max frame and message size       Resolves: bz#1815187

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4690 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: XML entity expansion vulnerability (CVE-2015-9541)

    * qt5-qtwebsockets: websocket implementation allows only limited size for frames and messages therefore     attacker can cause DOS (CVE-2018-21035)

    * qt: files placed by attacker can influence the working directory and lead to malicious code execution     (CVE-2020-0569)

    * qt: files placed by attacker can influence the working directory and lead to malicious code execution     (CVE-2020-0570)

    * qt5: incorrectly calls SSL_shutdown() in OpenSSL mid-handshake causing denial of service in TLS     applications (CVE-2020-13962)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198847	RHEL 7 : qt5-qtwebsockets (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196220	RHEL 7 : qt5-qtwebsockets (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
184835	Rocky Linux 8 : qt5-qtbase and qt5-qtwebsockets (RLSA-2020:4690)	Nessus	Rocky Linux Local Security Checks	high
157637	AlmaLinux 8 : qt5-qtbase and qt5-qtwebsockets (ALSA-2020:4690)	Nessus	Alma Linux Local Security Checks	high
147358	NewStart CGSL MAIN 6.02 : qt5-qtwebsockets Vulnerability (NS-SA-2021-0085)	Nessus	NewStart CGSL Local Security Checks	high
146016	CentOS 8 : qt5-qtbase and qt5-qtwebsockets (CESA-2020:4690)	Nessus	CentOS Local Security Checks	high
142803	Oracle Linux 8 : qt5-qtbase / and / qt5-qtwebsockets (ELSA-2020-4690)	Nessus	Oracle Linux Local Security Checks	high
142445	RHEL 8 : qt5-qtbase and qt5-qtwebsockets (RHSA-2020:4690)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2018-21035

high

Tenable Plugins

high

high

high

high

high

high

high

high