REDHAT-BUG-2424652: Medium severity WebKit WebKitGTK vulnerability
An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP requests. Applications expect to use the WebPage::send-request signal handler to approve or reject all network requests. However, certain types of HTTP requests bypass this signal handler. Additionally, WebKit may create network connections that do not correspond to HTTP requests, such as for rel="preconnect". When WebKit is used by an email client, these flaws may be abused to allow the sender of an email to inappropriately detect that the email has been viewed by the recipient.
Affected versions: all versions of WebKitGTK and WPE WebKit
Credit to: Albrecht Dreß
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2424652?
The severity of REDHAT-BUG-2424652 is considered critical due to its potential impact on network request handling.
How do I fix REDHAT-BUG-2424652?
Fixing REDHAT-BUG-2424652 requires updating to a patched version of WebKitGTK or WPE WebKit that addresses the API design flaw.
What types of software are affected by REDHAT-BUG-2424652?
REDHAT-BUG-2424652 affects WebKitGTK and WPE WebKit versions starting from 0 and above.
What is the primary issue in REDHAT-BUG-2424652?
The primary issue in REDHAT-BUG-2424652 is the failure of the WebPage::send-request signal handler to properly restrict untrusted web content from making network requests.
Can REDHAT-BUG-2424652 affect application security?
Yes, REDHAT-BUG-2424652 can severely impact application security by allowing untrusted content to perform potentially malicious network actions.