oss-sec mailing list archives
CVE request: password exposure in kdelibs when showing "internal server error" messages
From: Vincent Danen <vdanen () redhat com>
Date: Fri, 10 May 2013 15:28:33 -0600
I've not seen this yet; could a CVE be assigned to the following issue? It was reported that when KDE encounters an "internal server error" and also prints out the URL that caused the error that it would include the username and password (if supplied) to the resource that caused the error. For instance, it would show "https://user:password () remotehost com" or similar. This is due to kioslave/http/http.cpp using m_request.url.url() rather than the sanitized m_request.url.prettyUrl(). This issue is fixed in git. Note that this information is printed out to the local user actively using the computer. References: https://bugs.kde.org/show_bug.cgi?id=319428 https://projects.kde.org/projects/kde/kdelibs/repository/revisions/65d736dab592bced4410ccfa4699de89f78c96ca/diff/kioslave/http/http.cpp https://bugs.mageia.org/show_bug.cgi?id=10037 https://bugzilla.redhat.com/show_bug.cgi?id=961981 --Vincent Danen / Red Hat Security Response Team
Current thread:
- CVE request: password exposure in kdelibs when showing "internal server error" messages Vincent Danen (May 10)
- Re: CVE request: password exposure in kdelibs when showing "internal server error" messages Kurt Seifried (May 10)