[SM-Security] [Bug 3881] New: Konqueror authentication credentials leak (KDE <= 3.1.2)

bugzilla-daemon at metalab.unc.edu bugzilla-daemon at metalab.unc.edu
Sat Aug 2 09:42:41 EDT 2003


http://bugs.sourcemage.org/show_bug.cgi?id=3881

           Summary: Konqueror authentication credentials leak (KDE <= 3.1.2)
           Product: Security
           Version: unspecified
          Platform: Other
               URL: http://www.kde.org/info/security/advisory-20030729-1.txt
        OS/Version: other
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Security Issue
        AssignedTo: sm-security at lists.ibiblio.org
        ReportedBy: g.clay at warwick.ac.uk


The KDE team have identified a security leak in the Konqueror browser. Here's an excerpt from their 
security advisory: 
 
"Konqueror may inadvertently send authentication credentials to 
websites other than the intended website in clear text via the HTTP-referer 
header when authentication credentials are passed as part of a URL in the form 
of http://user:password@host/" 
 
The fix is to upgrade to KDE 3.1.3, which was released recently. Hopefully it should just be a case of 
bumping some version numbers :)



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.



More information about the SM-Security mailing list