CVE-2018-21035

In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumption).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 64%
Affected Products (NVD)
VendorProductVersion
qtqt
𝑥
≤ 5.14.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
qtwebsockets-opensource-src
bookworm
5.15.8-2
fixed
bullseye
5.15.2-2
fixed
buster
ignored
jessie
no-dsa
sid
5.15.15-2
fixed
stretch
ignored
trixie
5.15.13-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
qtwebsockets-opensource-src
bionic
needs-triage
eoan
ignored
focal
needs-triage
groovy
ignored
hirsute
not-affected
impish
not-affected
jammy
not-affected
kinetic
not-affected
lunar
not-affected
mantic
not-affected
noble
not-affected
trusty
dne
xenial
needs-triage
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
qt5-assistant
RHEL 8
0:5.12.5-2.el8
fixed
qt5-designer
RHEL 8
0:5.12.5-2.el8
fixed
qt5-doctools
RHEL 8
0:5.12.5-2.el8
fixed
qt5-linguist
RHEL 8
0:5.12.5-2.el8
fixed
qt5-qdbusviewer
RHEL 8
0:5.12.5-2.el8
fixed
qt5-qtbase
RHEL 8
0:5.12.5-6.el8
fixed
qt5-qtbase-common
RHEL 8
0:5.12.5-6.el8
fixed
qt5-qtbase-devel
RHEL 8
0:5.12.5-6.el8
fixed
qt5-qtbase-examples
RHEL 8
0:5.12.5-6.el8
fixed
qt5-qtbase-gui
RHEL 8
0:5.12.5-6.el8
fixed
qt5-qtbase-mysql
RHEL 8
0:5.12.5-6.el8
fixed
qt5-qtbase-odbc
RHEL 8
0:5.12.5-6.el8
fixed
qt5-qtbase-postgresql
RHEL 8
0:5.12.5-6.el8
fixed
qt5-qtbase-private-devel
RHEL 8
0:5.12.5-6.el8
fixed
qt5-qtbase-static
RHEL 8
0:5.12.5-6.el8
fixed
qt5-qttools
RHEL 8
0:5.12.5-2.el8
fixed
qt5-qttools-common
RHEL 8
0:5.12.5-2.el8
fixed
qt5-qttools-devel
RHEL 8
0:5.12.5-2.el8
fixed
qt5-qttools-examples
RHEL 8
0:5.12.5-2.el8
fixed
qt5-qttools-libs-designer
RHEL 8
0:5.12.5-2.el8
fixed
qt5-qttools-libs-designercomponents
RHEL 8
0:5.12.5-2.el8
fixed
qt5-qttools-libs-help
RHEL 8
0:5.12.5-2.el8
fixed
qt5-qttools-static
RHEL 8
0:5.12.5-2.el8
fixed
qt5-qtwebsockets
RHEL 8
0:5.12.5-2.el8
fixed
qt5-qtwebsockets-devel
RHEL 8
0:5.12.5-2.el8
fixed
qt5-qtwebsockets-examples
RHEL 8
0:5.12.5-2.el8
fixed
Common Weakness Enumeration
References
https://bugreports.qt.io/browse/QTBUG-70693
https://codereview.qt-project.org/c/qt/qtwebsockets/+/284735
https://bugreports.qt.io/browse/QTBUG-70693
https://codereview.qt-project.org/c/qt/qtwebsockets/+/284735