Source: qtwebsockets-opensource-src Version: 5.14.1-1 Severity: important Tags: security upstream Forwarded: https://bugreports.qt.io/browse/QTBUG-70693 Control: found -1 5.12.5-2 Control: found -1 5.11.3-5
Hi, The following vulnerability was published for qtwebsockets-opensource-src. CVE-2018-21035[0]: | In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB | for frames and 2GB for messages. Smaller limits cannot be configured. | This makes it easier for attackers to cause a denial of service | (memory consumption). If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2018-21035 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-21035 [1] https://bugreports.qt.io/browse/QTBUG-70693 [2] https://codereview.qt-project.org/c/qt/qtwebsockets/+/284735 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
