Bug 1810964 (CVE-2018-21035) - CVE-2018-21035 qt5-qtwebsockets: websocket implementation allows only limited size for frames and messages therefore attacker can cause DOS
Summary: CVE-2018-21035 qt5-qtwebsockets: websocket implementation allows only limited...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-21035
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1810965 1810966 1815184 1815187 1819874 1819875
Blocks: 1810969
TreeView+ depends on / blocked
 
Reported: 2020-03-06 10:21 UTC by Michael Kaplan
Modified: 2020-11-04 03:02 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2020-11-04 02:24:44 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:4690 0 None None None 2020-11-04 03:02:52 UTC

Description Michael Kaplan 2020-03-06 10:21:36 UTC 
In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumption).

Upstream Issue:

https://bugreports.qt.io/browse/QTBUG-70693

Upstream Fix:

https://codereview.qt-project.org/c/qt/qtwebsockets/+/284735
Comment 1 Michael Kaplan 2020-03-06 10:22:07 UTC 
Created qt5-qtwebsockets tracking bugs for this issue:

Affects: epel-6 [bug 1810966]
Affects: fedora-all [bug 1810965]
Comment 3 Marco Benatto 2020-03-19 18:40:13 UTC 
Upstream commit for this issue:
https://codereview.qt-project.org/gitweb?p=qt%2Fqtwebsockets.git;a=commit;h=ed93680f34e92ad0383aa4e610bb65689118ca93
Comment 4 Product Security DevOps Team 2020-11-04 02:24:44 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-21035
Comment 5 errata-xmlrpc 2020-11-04 03:02:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:4690 https://access.redhat.com/errata/RHSA-2020:4690
Note You need to log in before you can comment on or make changes to this bug.