Description
kio/kio/tcpslavebase.cpp in KDE KSSL in kdelibs before 4.6.1 does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a certificate issued by a legitimate Certification Authority for an IP address, a different vulnerability than CVE-2009-2702.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | kdelibs +3 | 6:4.3.4-11.el6_0.2 | RHSA-2011:0464 |
Advisories 1
- RHSA-2011:0464 Red Hat Security Advisory: kdelibs security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- ADV-2011-0990 vdb-entry
- MDVSA-2011:071 vendor-advisory
- 46789 vdb-entry
- 44108 third-party-advisory
- USN-1110-1 vendor-advisory
- ADV-2011-0913 vdb-entry
- https://projects.kde.org/projects/kde/kdelibs/repository/revisions/76f935197599a335a5fe09b78751ddb455248cf7
- [oss-security] 20110308 KDE SSL name check issue mailing-list
- kdelibs-ssl-security-bypass(65986) vdb-entry
- [oss-security] 20110308 Re: KDE SSL name check issue mailing-list