Bug 1649420 (CVE-2018-19120)

Summary: CVE-2018-19120 kio-extras: HTML Thumbnailer automatic remote file access
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED UPSTREAM QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: rdieter
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: kio-extras 18.12.0 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-10 10:42:36 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1649421    
Bug Blocks:    

Description Andrej Nemec 2018-11-13 15:16:53 UTC 
Various KDE applications share a plugin system to create thumbnails
of various file types for displaying in file managers, file dialogs, etc.

kio-extras contains a thumbnailer plugin for HTML files.

The HTML thumbnailer was incorrectly accessing some content of
remote URLs listed in HTML files. This meant that the owners of the servers
referred in HTML files in your system could have seen in their access logs
your IP address every time the thumbnailer tried to create the thumbnail.

The HTML thumbnailer has been removed in upcoming KDE Applications 18.12.0
because it was actually not creating thumbnails for files at all.

External References:

https://www.kde.org/info/security/advisory-20181012-1.txt
Comment 1 Andrej Nemec 2018-11-13 15:17:08 UTC 
Created kio-extras tracking bugs for this issue:

Affects: fedora-all [bug 1649421]
Comment 2 Product Security DevOps Team 2019-06-10 10:42:36 UTC 
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.