CVE-2024-36048 Weak cryptography in n/a
Weak PRNG seeding in Qt Network Authorization allows attackers to guess values, potentially bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-36048?
CVE-2024-36048 is a critical vulnerability in Fedoraproject Fedora, published on 18 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values.
Weakness: CWE-335
Which versions are affected by CVE-2024-36048?
It affects 2 products.
Linux distribution packages (6)
libqt5-qtnetworkauth SUSE:Package Hub 15 SP5 | All versions | 5.15.2+kde2-bp155.3.3.1 |
qt6-networkauth SUSE:Package Hub 15 SP5 | All versions | 6.4.2-bp155.2.3.1 |
qt6-networkauth-docs SUSE:Package Hub 15 SP5 | All versions | 6.4.2-bp155.2.3.1 |
libqt5-qtnetworkauth openSUSE:Leap 15.5 | All versions | 5.15.2+kde2-bp155.3.3.1 |
qt6-networkauth openSUSE:Leap 15.5 | All versions | 6.4.2-bp155.2.3.1 |
qt6-networkauth-docs openSUSE:Leap 15.5 | All versions | 6.4.2-bp155.2.3.1 |
Products include Fedoraproject Fedora, Qt Qt.
How do I fix CVE-2024-36048?
Upgrade to a fixed version.
Is CVE-2024-36048 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-36048 exists.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2024-36048, GHSA-r8x8-rv8c-j266, MGASA-2024-0197, OESA-2025-1140, OESA-2025-1141, OESA-2025-1142 and 6 more.