PT-2020-15770 · Mlt · Shotcut

Ddennedy · Published 2020-09-22 · Updated 2021-07-21 · CVE-2020-24619

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Shotcut versions prior to 20.09.13

Description The issue arises from the misuse of TLS in the upgrade check due to the setting of setPeerVerifyMode(QSslSocket::VerifyNone) in mainwindow.cpp. This could allow a man-in-the-middle attacker to offer a spoofed download resource.

Recommendations For versions prior to 20.09.13, update to version 20.09.13 or later to resolve the issue. As a temporary workaround, consider restricting network access to trusted sources until the update is applied.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2020-24619

Affected Products

Shotcut

References · 7

• https://github.com/mltframework/shotcut/commit/f008adc039642307f6ee3378d378cdb842e52c1d · Patch
• https://ubuntu.com/security/CVE-2020-24619 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-24619 · Vendor Advisory
• https://shotcut.org/blog/new-release-200913 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-24619 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24619 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24619 · Security Note