p PatchFirst

CVE-2023-32762

CVE-2023-32762

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match.

CVSS 5.3 · Medium · EPSS 0.9% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • qt6-base Debian:12

    Affected ranges
    • ECOSYSTEM: < 6.4.2+dfsg-9

    Update to 6.4.2+dfsg-9

  • qt6-base Debian:13

    Affected ranges
    • ECOSYSTEM: < 6.4.2+dfsg-9

    Update to 6.4.2+dfsg-9

  • qt6-base Debian:14

    Affected ranges
    • ECOSYSTEM: < 6.4.2+dfsg-9

    Update to 6.4.2+dfsg-9

  • qtbase-opensource-src Debian:12

    Affected ranges
    • ECOSYSTEM: < 5.15.8+dfsg-10

    Update to 5.15.8+dfsg-10

  • qtbase-opensource-src Debian:13

    Affected ranges
    • ECOSYSTEM: < 5.15.8+dfsg-10

    Update to 5.15.8+dfsg-10

  • qtbase-opensource-src Debian:14

    Affected ranges
    • ECOSYSTEM: < 5.15.8+dfsg-10

    Update to 5.15.8+dfsg-10

  • qtbase-opensource-src-gles Ubuntu:16.04:LTS

    Versions
    • 5.4.2+dfsg-2ubuntu9
    • 5.5.1+dfsg-6ubuntu1
    • 5.5.1+dfsg-10ubuntu1
    • 5.5.1+dfsg-13ubuntu1
    • 5.5.1+dfsg-13ubuntu2
    • 5.5.1+dfsg-13ubuntu3
    • 5.5.1+dfsg-14ubuntu1
    • 5.5.1+dfsg-14ubuntu2
    • 5.5.1+dfsg-14ubuntu3
    • 5.5.1+dfsg-15ubuntu1
    • 5.5.1+dfsg-16ubuntu1
    • 5.5.1+dfsg-16ubuntu4
    • 5.5.1+dfsg-16ubuntu5
    • 5.5.1+dfsg-16ubuntu6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • qtbase-opensource-src Ubuntu:Pro:18.04:LTS

    Versions
    • 5.9.1+dfsg-10ubuntu1
    • 5.9.1+dfsg-10ubuntu2
    • 5.9.2+dfsg-4ubuntu6
    • 5.9.3+dfsg-0ubuntu1
    • 5.9.3+dfsg-0ubuntu3
    • 5.9.3+dfsg-0ubuntu4
    • 5.9.4+dfsg-0ubuntu3
    • 5.9.4+dfsg-0ubuntu4
    • 5.9.5+dfsg-0ubuntu1
    • 5.9.5+dfsg-0ubuntu2
    • 5.9.5+dfsg-0ubuntu2.1
    • 5.9.5+dfsg-0ubuntu2.3
    • 5.9.5+dfsg-0ubuntu2.4
    • 5.9.5+dfsg-0ubuntu2.5
    • 5.9.5+dfsg-0ubuntu2.6
    Affected ranges
    • ECOSYSTEM: < 5.9.5+dfsg-0ubuntu2.6+esm1

    Update to 5.9.5+dfsg-0ubuntu2.6+esm1

  • qtbase-opensource-src Ubuntu:Pro:20.04:LTS

    Versions
    • 5.12.4+dfsg-4ubuntu1
    • 5.12.5+dfsg-2
    • 5.12.5+dfsg-8
    • 5.12.5+dfsg-8build1
    • 5.12.5+dfsg-9build1
    • 5.12.8+dfsg-0ubuntu1
    • 5.12.8+dfsg-0ubuntu2.1
    Affected ranges
    • ECOSYSTEM: < 5.12.8+dfsg-0ubuntu2.1+esm1

    Update to 5.12.8+dfsg-0ubuntu2.1+esm1

  • qtbase-opensource-src-gles Ubuntu:20.04:LTS

    Versions
    • 5.12.4+dfsg-1build1
    • 5.12.5+dfsg-1
    • 5.12.5+dfsg-2
    • 5.12.8+dfsg-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • qt6-base Ubuntu:22.04:LTS

    Versions
    • 6.2.2+dfsg-5ubuntu1
    • 6.2.2+dfsg-6ubuntu1
    • 6.2.2+dfsg-6ubuntu2
    • 6.2.4+dfsg-1ubuntu1
    • 6.2.4+dfsg-2ubuntu1
    • 6.2.4+dfsg-2ubuntu1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • qtbase-opensource-src-gles Ubuntu:22.04:LTS

    Versions
    • 5.15.2+dfsg-4
    • 5.15.2+dfsg-5
    • 5.15.3+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • qtbase-opensource-src Ubuntu:Pro:22.04:LTS

    Versions
    • 5.15.2+dfsg-12
    • 5.15.2+dfsg-13
    • 5.15.2+dfsg-14
    • 5.15.2+dfsg-14ubuntu1
    • 5.15.2+dfsg-14ubuntu3
    • 5.15.2+dfsg-15
    • 5.15.3+dfsg-1
    • 5.15.3+dfsg-2
    • 5.15.3+dfsg-2ubuntu0.1
    • 5.15.3+dfsg-2ubuntu0.2
    Affected ranges
    • ECOSYSTEM: < 5.15.3+dfsg-2ubuntu0.2+esm1

    Update to 5.15.3+dfsg-2ubuntu0.2+esm1

  • qt6-base Ubuntu:24.04:LTS

    Versions
    • 6.4.2+dfsg-18
    • 6.4.2+dfsg-19
    • 6.4.2+dfsg-19build1
    • 6.4.2+dfsg-20
    • 6.4.2+dfsg-21
    • 6.4.2+dfsg-21.1build4
    • 6.4.2+dfsg-21.1build5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • qtbase-opensource-src-gles Ubuntu:24.04:LTS

    Versions
    • 5.15.10+dfsg-2
    • 5.15.10+dfsg-3
    • 5.15.12+dfsg-1
    • 5.15.12+dfsg-1ubuntu1
    • 5.15.12+dfsg-1ubuntu2
    • 5.15.13+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • qt6-base Ubuntu:25.10

    Versions
    • 6.8.3+dfsg-0ubuntu2
    • 6.8.3+dfsg-0ubuntu3
    • 6.9.2+dfsg-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • qtbase-opensource-src-gles Ubuntu:25.10

    Versions
    • 5.15.15+dfsg-2
    • 5.15.17+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • qt6-base Ubuntu:26.10

    Versions
    • 6.10.2+dfsg-7
    • 6.10.2+dfsg-14ubuntu2
    • 6.10.2+dfsg-15
    • 6.10.2+dfsg-16
    • 6.11.2+dfsg-4ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • qtbase-opensource-src-gles Ubuntu:26.10

    Versions
    • 5.15.18+dfsg-1
    • 5.15.19+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • qt6-base Ubuntu:26.04:LTS

    Versions
    • 6.9.2+dfsg-1ubuntu1
    • 6.9.2+dfsg-2
    • 6.9.2+dfsg-3ubuntu1
    • 6.9.2+dfsg-3ubuntu2
    • 6.9.2+dfsg-4
    • 6.10.2+dfsg-3
    • 6.10.2+dfsg-6
    • 6.10.2+dfsg-7
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • qtbase-opensource-src-gles Ubuntu:26.04:LTS

    Versions
    • 5.15.17+dfsg-1
    • 5.15.17+dfsg-2
    • 5.15.18+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →