CVE-2018-21035

See a problem?

Source

https://nvd.nist.gov/vuln/detail/CVE-2018-21035

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-21035.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2018-21035

Related

Published

2020-02-28T21:15:12Z

Modified

2024-06-30T12:01:22Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumption).

References

Affected packages

Debian:11 / qtwebsockets-opensource-src

Package

Name: qtwebsockets-opensource-src
Purl: pkg:deb/debian/qtwebsockets-opensource-src?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.15.1-2

Ecosystem specific

{
    "urgency": "low"
}

Debian:12 / qtwebsockets-opensource-src

Package

Name: qtwebsockets-opensource-src
Purl: pkg:deb/debian/qtwebsockets-opensource-src?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.15.1-2

Ecosystem specific

{
    "urgency": "low"
}

Debian:13 / qtwebsockets-opensource-src

Package

Name: qtwebsockets-opensource-src
Purl: pkg:deb/debian/qtwebsockets-opensource-src?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.15.1-2

Ecosystem specific

{
    "urgency": "low"
}