Vulnerabilities > CVE-2020-11054

047910
CVSS 3.5 - LOW
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
LOW
Integrity impact
NONE
Availability impact
NONE
network
low complexity
qutebrowser
fedoraproject
nessus
NVD
Published: 2020-05-07
Updated: 2024-11-21

Summary

In qutebrowser versions less than 1.11.1, reloading a page with certificate errors shows a green URL. After a certificate error was overridden by the user, qutebrowser displays the URL as yellow (colors.statusbar.url.warn.fg). However, when the affected website was subsequently loaded again, the URL was mistakenly displayed as green (colors.statusbar.url.success_https). While the user already has seen a certificate error prompt at this point (or set content.ssl_strict to false, which is not recommended), this could still provide a false sense of security. This has been fixed in 1.11.1 and 1.12.0. All versions of qutebrowser are believed to be affected, though versions before v0.11.x couldn't be tested. Backported patches for older versions (greater than or equal to 1.4.0 and less than or equal to 1.10.2) are available, but no further releases are planned.

Vulnerable Configurations

Part Description Count
Application
Qutebrowser
53
OS
Fedoraproject
2

Nessus

NASL familyFreeBSD Local Security Checks
NASL idFREEBSD_PKG_452D16BB920D11EA9D2018A6F7016652.NASL
descriptionQutebrowser developers report : After a certificate error was overridden by the user, qutebrowser displays the URL as yellow (colors.statusbar.url.warn.fg). However, when the affected website was subsequently loaded again, the URL was mistakenly displayed as green (colors.statusbar.url.success_https). While the user already has seen a certificate error prompt at this point (or set content.ssl_strict to false which is not recommended), this could still provide a false sense of security.
last seen2020-05-16
modified2020-05-11
plugin id136442
published2020-05-11
reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/136442
titleFreeBSD : qutebrowser -- Reloading page with certificate errors shows a green URL (452d16bb-920d-11ea-9d20-18a6f7016652)

References