Log in Start free

Vulnerability · Published May 18, 2024 · Assigned by mitre

CVE-2024-36048

Critical 9.8

In plain English

A critical-severity security flaw in the qt6-networkauth package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.0%top 37.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12qt6-networkauthno fix listedDEBIAN-CVE-2024-36048
Debian:13qt6-networkauth6.7.2-2DEBIAN-CVE-2024-36048
Debian:14qt6-networkauth6.7.2-2DEBIAN-CVE-2024-36048
Debian:12qtnetworkauth-everywhere-srcno fix listedDEBIAN-CVE-2024-36048
Debian:13qtnetworkauth-everywhere-src5.15.13-3DEBIAN-CVE-2024-36048
Debian:14qtnetworkauth-everywhere-src5.15.13-3DEBIAN-CVE-2024-36048
Ubuntu:22.04:LTSqtnetworkauth-everywhere-srcno fix listedUBUNTU-CVE-2024-36048
Ubuntu:24.04:LTSqtnetworkauth-everywhere-srcno fix listedUBUNTU-CVE-2024-36048
Ubuntu:25.10qtnetworkauth-everywhere-srcno fix listedUBUNTU-CVE-2024-36048
Ubuntu:26.04:LTSqtnetworkauth-everywhere-srcno fix listedUBUNTU-CVE-2024-36048
Ubuntu:26.10qtnetworkauth-everywhere-srcno fix listedUBUNTU-CVE-2024-36048

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-335 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References