PT-2018-10770 · Webkit+4 · Webkitgtk+4

Michael Catanzaro · Publicado 2018-05-09 · Atualizado 2018-11-15 · CVE-2018-11712

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WebKitGTK+ versions 2.20.0 through 2.20.1

Description The issue is related to the libsoup network backend of WebKit, specifically in the WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp file. It failed to perform TLS certificate verification for WebSocket connections.

Recommendations For WebKitGTK+ versions 2.20.0 and 2.20.1, consider updating to a version that includes the fix for this issue, as the current versions do not properly verify TLS certificates for WebSocket connections. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

ALT-PU-2018-1681

CESA-2018_3140

CVE-2018-11712

OPENSUSE-SU-2018_3473-1

RHSA-2018:3140

RHSA-2018_3140

SUSE-SU-2018:3387-1

Produtos afetados

Alt Linux

Centos

Red Hat

Suse

Webkitgtk

Referências · 68

• https://suse.com/security/cve/CVE-2017-7153 · Nota
• https://security-tracker.debian.org/tracker/CVE-2018-11712 · Aviso do Fabricante
• https://webkitgtk.org/security/WSA-2018-0005.html · Nota
• https://suse.com/security/cve/CVE-2018-11713 · Nota
• https://bugzilla.suse.com/1095611 · Nota
• https://suse.com/security/cve/CVE-2018-4122 · Nota
• https://suse.com/security/cve/CVE-2018-4127 · Nota
• https://bugzilla.suse.com/1101999 · Nota
• https://suse.com/security/cve/CVE-2018-4246 · Nota
• https://bugzilla.suse.com/1075775 · Nota
• https://bugzilla.suse.com/1102530 · Nota
• https://osv.dev/vulnerability/CVE-2018-11712 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-4101 · Nota
• https://security.gentoo.org/glsa/201808-04 · Aviso do Fabricante
• https://bugzilla.suse.com/1088932 · Nota