Description
Konqueror Embedded and KDE 2.2.2 and earlier does not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof certificates via a man-in-the-middle attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 1
- DSA-361 kdelibs, kdelibs-crypto - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2003:192 vendor-advisory
- 20030510 [forward]Apple Safari and Konqueror Embedded Common Name Verification Vulnerability mailing-list
- TLSA-2003-36 vendor-advisory
- RHSA-2003:193 vendor-advisory
- 20030507 Problem: Multiple Web Browsers do not do not validate CN on certificates. mailing-list
- DSA-361 vendor-advisory
- http://www.kde.org/info/security/advisory-20030602-1.txt
- 7520 vdb-entry