[<prev] [next>] [day] [month] [year] [list]
Message-Id: <1628031289.fehtmg1vfv.none@localhost>
Date: Tue, 03 Aug 2021 19:48:45 -0400
From: "Alex Xu (Hello71)" <alex_y_xu@...oo.ca>
To: oss-security@...ts.openwall.com
Subject: Reminder: QtWebKit known vulnerabilities
Quoting Christophe Giboudeaux [0] (excerpted, rewrapped),
> QtWebKit was a rendering engine for web content released with Qt until
> 5.6. It was replaced with QtWebEngine after that.
>
> Despite a community fork in 2016, nothing really happened to keep it
> alive and secure.
> Quoting the QtWebKit release page on Github:
>
> "WARNING: This release is based on old WebKit revision with known
> unpatched vulnerabilities.
> Please use it carefully and avoid visiting untrusted websites and
> using it for transmission of sensitive data."
As of today, Repology reports that 246 packages still exist for
qt5-webkit, in dozens of Linux distros (most of them overcounted, e.g.
qt5-qtwebkit-dev).
Of particular concern is the 104 packages known for wkhtmltopdf. As
repeated multiple times on the website (unfortunately not prominently
enough), "Do not use wkhtmltopdf with any untrusted HTML". However, it's
fair to say that many users likely do not follow this advice.
Readers of this list will likely be familiar with the regular postings
regarding WebKitGTK vulnerabilities: many of them are likely applicable
to QtWebKit too, especially the WebKitGTK-based fork.
Fortunately, as opposed to the webkitgtk issues a few years ago, most
programs now support Qt WebEngine, QTextBrowser (part of Qt Widgets), or
don't require any browser engine anymore. Almost all exceptions are no
longer maintained upstream. wkhtmltopdf is likely the most used package
that still requires QtWebKit, but in my opinion is the most dangerous,
as users may unknowingly install it from distro repositories and use it
to process untrusted data. Users can migrate to weasyprint, puppeteer,
or another alternative.
Alpine Linux has removed QtWebKit [1], Gentoo Linux has masked it [2]
(meaning users must manually approve the installation), and OpenSUSE
will be removing it soon [0]. In the absence of a maintained QtWebKit,
I urge other distros to follow suit to protect Linux users.
[0] https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/GXVEFT7VY5DQNATX6FHJBQBRDHRC3NRN/
[1] https://gitlab.alpinelinux.org/alpine/aports/-/issues/12888
[2] https://bugs.gentoo.org/684580
Regards,
Alex.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
