CVE-2020-13962

Public Exploit

Description

Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails. (Mumble 1.3.1 is not affected, regardless of the Qt version.)

7.5

CVSS

Severity: High

CVSS 3.1 •

CVSS 2.0 •

EPSS 1.56% Top 20%

Vendor Advisory gentoo.org Vendor Advisory opensuse.org Vendor Advisory fedoraproject.org Vendor Advisory fedoraproject.org Vendor Advisory fedoraproject.org Vendor Advisory qt.io

Affected: n/a n/a

References

Link	Tags
https://github.com/mumble-voip/mumble/pull/4032	third party advisory patch
https://bugreports.qt.io/browse/QTBUG-83450	vendor advisory issue tracking
https://github.com/mumble-voip/mumble/issues/3679	patch exploit third party advisory issue tracking
https://security.gentoo.org/glsa/202007-18	third party advisory vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00004.html	vendor advisory mailing list third party advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3IZY7LKJ6NAXQDFYFR4S7L5BBHYK53K/	vendor advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X6EDPIIAQPVP2CHL2CHDHJ25EECA7UE/	vendor advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQJDBZUYMMF4R5QQKD2HTIKQU2NSKO63/	vendor advisory

Frequently Asked Questions

What is the severity of CVE-2020-13962?: CVE-2020-13962 has been scored as a high severity vulnerability.
How to fix CVE-2020-13962?: To fix CVE-2020-13962, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2020-13962 being actively exploited in the wild?: It is possible that CVE-2020-13962 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~2% probability that this vulnerability will be exploited by malicious actors in the next 30 days.