CVE-2023-32762
- Source
- https://cve.org/CVERecord?id=CVE-2023-32762
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-32762.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2023-32762
- Downstream
- Related
- Published
- 2023-05-28T23:15:09.570Z
- Modified
- 2026-02-14T00:20:43.002420Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match.
- References
-
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/476140
- https://github.com/qt/qtbase/commit/1b736a815be0222f4b24289cf17575fc15707305
- https://lists.qt-project.org/pipermail/announce/2023-May/000414.html
- https://lists.qt-project.org/pipermail/announce/2023-May/000414.html
Affected packages
Git / github.com/qt/qt5
Git / github.com/qt/qtbase
Affected ranges
- Type
- GIT
- Repo
- https://github.com/qt/qtbase
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedIntroducedFixedIntroducedFixed
Affected versions
v5.*
v5.10.0
v5.10.0-alpha1
v5.10.0-beta1
v5.10.0-beta2
v5.10.0-beta3
v5.10.0-beta4
v5.10.0-rc1
v5.10.0-rc2
v5.10.0-rc3
v5.10.1
v5.11.0
v5.11.0-alpha1
v5.11.0-beta1
v5.11.0-beta2
v5.11.0-beta3
v5.11.0-beta4
v5.11.0-rc1
v5.11.0-rc2
v5.11.1
v5.11.2
v5.11.3
v5.12.0
v5.12.0-alpha1
v5.12.0-beta1
v5.12.0-beta2
v5.12.0-beta3
v5.12.0-beta4
v5.12.0-rc1
v5.12.0-rc2
v5.12.1
v5.12.2
v5.12.3
v5.12.4
v5.12.5
v5.13.0
v5.13.0-alpha1
v5.13.0-beta1
v5.13.0-beta2
v5.13.0-beta3
v5.13.0-beta4
v5.13.0-rc1
v5.13.0-rc2
v5.13.0-rc3
v5.13.1
v5.13.2
v5.14.0
v5.14.0-alpha1
v5.14.0-beta1
v5.14.0-beta2
v5.14.0-beta3
v5.14.0-rc1
v5.14.0-rc2
v5.14.1
v5.14.2
v5.15.0
v5.15.0-alpha1
v5.15.0-beta1
v5.15.0-beta2
v5.15.0-beta3
v5.15.0-beta4
v5.15.0-rc1
v5.15.0-rc2
v5.15.10-lts-lgpl
v5.15.11-lts-lgpl
v5.15.12-lts-lgpl
v5.15.13-lts-lgpl
v5.15.3-lts-lgpl
v5.15.4-lts-lgpl
v5.15.5-lts-lgpl
v5.15.6-lts-lgpl
v5.15.7-lts-lgpl
v5.15.8-lts-lgpl
v5.15.9-lts-lgpl
v5.9.0
v5.9.0-rc2
v5.9.1
v5.9.2
v5.9.3
v5.9.4
v6.*
v6.0.0-alpha1
v6.0.0-beta1
v6.0.0-beta2
v6.0.0-beta3
v6.0.0-beta4
v6.0.0-beta5
v6.2.0-alpha1
v6.2.0-beta1
v6.2.0-beta2
v6.2.0-beta3
v6.2.0-beta4
v6.2.5-lts-lgpl
v6.2.6-lts-lgpl
v6.2.7-lts-lgpl
v6.2.8-lts-lgpl
v6.5.0-beta1
v6.5.0-beta2
v6.5.0-beta3
Database specific
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-32762.json"
vanir_signatures
[
{
"digest": {
"line_hashes": [
"198455504285215276206513920714838399588",
"280746894577215508959761652343184383218",
"248521215612386692078688414216867720462",
"66058527147137772403119859541830059642"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "src/network/access/qhsts.cpp"
},
"signature_type": "Line",
"id": "CVE-2023-32762-1d1a0a9d",
"source": "https://github.com/qt/qtbase/commit/1b736a815be0222f4b24289cf17575fc15707305",
"deprecated": false
},
{
"digest": {
"function_hash": "202253668995713526950139037894621624785",
"length": 3714.0
},
"signature_version": "v1",
"target": {
"file": "tests/auto/network/access/hsts/tst_qhsts.cpp",
"function": "tst_QHsts::testSTSHeaderParser"
},
"signature_type": "Function",
"id": "CVE-2023-32762-65be528c",
"source": "https://github.com/qt/qtbase/commit/1b736a815be0222f4b24289cf17575fc15707305",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"92376634840184399825365318154288351993",
"232461204609313989120257745717201240216",
"320708743009817993507337202164167887441",
"21308290995217884491005044431632010900",
"298034914405986548572445818450155724325",
"171355919169060797509597056785544202524",
"1069687939198931456973687425830032072",
"3540876834910303010839964264776335282",
"119893641728366708810635981190240492131",
"135558535485227323371703831987671565962",
"218424658944840923178893068857589239342",
"180130516929332699035191217939835434911",
"171902681780682419451758795992574159417",
"194908686061445372061155934280632091709",
"25828914292029408919762996279289826136",
"271381063204330631592675759559091485281",
"188826755362610565145874472998653610620",
"61181470149620454368846073938918120330",
"144456116250144122357606448252883560018",
"210431344564871427713284927923317729215",
"33720891528493242799779644168988618648",
"131451878779952217380213242484707842149",
"163457716009692412014758585930328269677",
"48972863578760833987644564696874645146"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "src/network/kernel/qdnslookup_unix.cpp"
},
"signature_type": "Line",
"id": "CVE-2023-32762-95a33edc",
"source": "https://github.com/qt/qtbase/commit/55aee8697512af105dfefabc1e2ec41d4df1e45e",
"deprecated": false
},
{
"digest": {
"function_hash": "328679296815467547461728943587483981886",
"length": 7904.0
},
"signature_version": "v1",
"target": {
"file": "src/network/kernel/qdnslookup_unix.cpp",
"function": "QDnsLookupRunnable::query"
},
"signature_type": "Function",
"id": "CVE-2023-32762-b3d99a5e",
"source": "https://github.com/qt/qtbase/commit/55aee8697512af105dfefabc1e2ec41d4df1e45e",
"deprecated": false
}
]