PT-2021-17752 · Kde+1 · Kde Discover+1

Fabian Bräunlein · CVE-2021-28117 · Published 2021-03-18 · Updated 2024-10-15

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: KDE Discover versions prior to 5.21.3 KDE Discover versions prior to 5.18.7

Description: The issue arises from the automatic creation of links to potentially dangerous URLs based on the content of the store.kde.org web site. These URLs are neither https:// nor http://.

Recommendations: For versions prior to 5.21.3, update to version 5.21.3 or later. For versions prior to 5.18.7, update to version 5.18.7 or later.

Fix

Related Identifiers

ALT-PU-2021-1589

CVE-2021-28117

MGASA-2021-0146

Affected Products

Alt Linux

Kde Discover

References · 18

• https://github.com/KDE/discover/commit/fcd3b30552bf03a384b1a16f9bb8db029c111356 · Patch
• https://osv.dev/vulnerability/CVE-2021-28117 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28117 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-28117 · Security Note
• https://invent.kde.org/plasma/discover/commit/94478827aab63d2e2321f0ca9ec5553718798e60 · Patch
• https://kde.org/info/security/advisory-20210310-1.txt · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-28117 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0146 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-28117 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-28117 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0146.html · Security Note
• https://ubuntu.com/security/CVE-2021-28117 · Vendor Advisory
• https://userbase.kde.org/Discover · Vendor Advisory
• https://github.com/KDE/discover/releases · Note
• https://t.me/cvenotify/65449 · Telegram Post