CVE-2007-5965: Medium severity Trolltech QSslSocket vulnerability

Published Jan 8, 2008

Updated

QSslSocket in Trolltech Qt 4.3.0 through 4.3.2 does not properly verify SSL certificates, which might make it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service, or trick a service into accepting an invalid client certificate for a user.

Affected Software

3 affected components

Trolltech QSslSocket=4.3.1

Trolltech QSslSocket=4.3.0

Trolltech QSslSocket=4.3.2

Remediation

Patch Available

http://trolltech.com/company/newsroom/announcements/press.2007-12-21.2182567220

Event History

Jan 8, 2008

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-5965?

CVE-2007-5965 is considered a medium severity vulnerability due to its impact on SSL certificate verification.

How do I fix CVE-2007-5965?

To fix CVE-2007-5965, upgrade to a patched version of QSslSocket beyond 4.3.2.

What platforms are affected by CVE-2007-5965?

CVE-2007-5965 affects versions 4.3.0 to 4.3.2 of QSslSocket in Trolltech Qt.

What exploitation methods exist for CVE-2007-5965?

Attackers can exploit CVE-2007-5965 by tricking users or services into accepting invalid SSL certificates.

What is QSslSocket's role related to CVE-2007-5965?

QSslSocket is responsible for SSL connections and improperly verifying certificates in the affected versions.