Mageia 7 MGASA-2020-0475 Moderate: kdeconnect-kde Security Enhancement
mageia
December 29, 2020
For the pairing procedure, the GUI component only presented the friendly 'deviceName' to identify peer devices, which is completely under attacker control
Summary
For the pairing procedure, the GUI component only presented the friendly 'deviceName' to identify peer devices, which is completely under attacker control. Furthermore the 'deviceName' is transmitted in cleartext in UDP broadcast messages for all other nodes in the network segment to see. Therefore malicious devices can attempt to confuse users by requesting a
References
- https://bugs.mageia.org/show_bug.cgi?id=27700
- https://www.openwall.com/lists/oss-security/2020/11/30/1
-
Resolution
SRPMS
- 7/core/kdeconnect-kde-1.3.4-2.2.mga7
PREVIOUS
NEXT
Publication date: 29 Dec 2020
URL: https://advisories.mageia.org/MGASA-2020-0475.html
Type: security
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Related News
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!