PT-2023-3581 · Qt Company+6 · Qt+6
Published
2023-05-08
·
Updated
2026-04-01
·
CVE-2023-32762
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Qt versions prior to 5.15.14
Qt versions 6.x prior to 6.2.9
Qt versions 6.3.x through 6.5.x prior to 6.5.1
Description
An issue in Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This occurs if the case used for the HSTS header does not exactly match. The issue relates to the transmission of protected information in unencrypted form, potentially allowing a remote attacker to impact data integrity.
Recommendations
For Qt versions prior to 5.15.14, update to version 5.15.14 or later.
For Qt versions 6.x prior to 6.2.9, update to version 6.2.9 or later.
For Qt versions 6.3.x through 6.5.x prior to 6.5.1, update to version 6.5.1 or later.
Fix
Cleartext Transmission of Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Qt
Red Os
Suse
Ubuntu