From $URL : A security flaw was found in the way QSslSocket implementation of the Qt, a software toolkit for applications development, performed certificate verification callbacks, when Qt libraries were used with different OpenSSL version than the one, they were compiled against. In such scenario, this would result in a connection error, but with the SSL error list to contain QSslError:NoError instead of proper reason of the error. This might result in a confusing error being presented to the end users, possibly encouraging them to ignore the SSL errors for the site the connection was initiated against. References: [1] http://lists.qt-project.org/pipermail/announce/2013-January/000020.html Relevant upstream patch: [2] https://codereview.qt-project.org/#change,42461
Well... this does NOT affect us. We don't use dynamic loading of libssl, therefore the described scenario cannot happen.
(In reply to comment #1) > Well... this does NOT affect us. We don't use dynamic loading of libssl, > therefore the described scenario cannot happen. thanks.
CVE-2012-6093 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6093): The QSslSocket::sslErrors function in Qt before 4.6.5, 4.7.x before 4.7.6, 4.8.x before 4.8.5, when using certain versions of openSSL, uses an "incompatible structure layout" that can read memory from the wrong location, which causes Qt to report an incorrect error when certificate validation fails and might cause users to make unsafe security decisions to accept a certificate.
