QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-3936682805 advisory.

    Fix CVE-2024-36048

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-2e27372d4c advisory.

    Qt 5.15.14 bugfix update.

    ----

    Fix CVE-2024-36048

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-bfb8617ba3 advisory.

    Qt 6.7.1 bugfix update.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2024:0143-1 advisory.

    - CVE-2024-36048: Fixed data race and poor seeding in generateRandomString() (boo#1224782).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f5fa174d-19de-11ef-83d8-4ccc6adda413 advisory.

    Andy Shaw reports:
    The OAuth1 implementation in QtNetworkAuth created nonces using                 a PRNG that was seeded with a predictable seed.
    This means that an attacker that can somehow control the time of                 the first OAuth1 flow of the process has a high chance of predicting                 the nonce used in said OAuth flow.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2024:0138-1 advisory.

    - CVE-2024-36048: Fixed data race and poor seeding in generateRandomString() (boo#1224782).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
200111	Fedora 39 : qt5-qtnetworkauth (2024-3936682805)	Nessus	Fedora Local Security Checks	critical
200103	Fedora 40 : deepin-qt5integration / deepin-qt5platform-plugins / dwayland / etc (2024-2e27372d4c)	Nessus	Fedora Local Security Checks	critical
198057	Fedora 40 : fcitx5-qt / python-pyqt6 / qadwaitadecorations / qgnomeplatform / etc (2024-bfb8617ba3)	Nessus	Fedora Local Security Checks	critical
197949	openSUSE 15 Security Update : libqt5-qtnetworkauth (openSUSE-SU-2024:0143-1)	Nessus	SuSE Local Security Checks	critical
197922	FreeBSD : QtNetworkAuth -- predictable seeding of PRNG in QAbstractOAuth (f5fa174d-19de-11ef-83d8-4ccc6adda413)	Nessus	FreeBSD Local Security Checks	critical
197916	openSUSE 15 Security Update : qt6-networkauth (openSUSE-SU-2024:0138-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2024-36048

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical