Description

to a vulnerability affecting the qute://settings page, it was
possible for websites to modify settings. Via settings like
editor.command, this possibly allowed websites to execute arbitrary .

This issue has been assigned CVE-2018-10895.

Affected versions

The issue was introduced in v1.0.0, as part of commit ffc29ee.

It was fixed in the v1.4.1 release, in commit 43e58ac.

All releases between v1.0.0 and v1.4.0 (inclusive) are affected.
Backported patches are available, but no additional releases are planned:

(add .patch to the URL to get patches)

Timeline

2018-07-09: I was made aware of the original issue privately (initially
believed by the reporter to only be a DoS issue), developed a fix and contacted
the distros Openwall mailinglist to organize a disclosure date to give
distributions time to coordinate releasing of a fix.

2018-07-10: Slightly updated patch sent to the distros mailinglist.

2018-07-11: Public disclosure.

Mitigation

Please upgrade to v1.4.1 or apply the patches above.

Note that disabling loading of autoconfig.yml is not a suitable remedy, since
settings are still applied until the next restart.

As a workaround, it’s possible to patch out the vulnerable code via a
config.py file:

from qutebrowser.browser import qutescheme
qutescheme._qute_settings_set = lambda url: ('text/html', '')

While there is no known exploit for this in the wild, users are advised to
check their autoconfig.yml file (located in the config folder shown in
:version) for any unwanted modifications.



Source link

LEAVE A REPLY

Please enter your comment!
Please enter your name here