Bugzilla – Bug 3881
Konqueror authentication credentials leak (KDE <= 3.1.2)
Last modified: 2003-08-18 22:49:57 UTC
The KDE team have identified a security leak in the Konqueror browser. Here's an excerpt from their security advisory: "Konqueror may inadvertently send authentication credentials to websites other than the intended website in clear text via the HTTP-referer header when authentication credentials are passed as part of a URL in the form of http://user:password@host/" The fix is to upgrade to KDE 3.1.3, which was released recently. Hopefully it should just be a case of bumping some version numbers :)
Gareth, I'm building a modified kdelibs spell with the patches for testing. Since qt also needs to build, give it some time... then you can send a note to news.sourcemage.org to the security alerts section. You can do so now as well and state that an update to test and stable will be forthcoming, if you want.
Okay I've posted the news. It's the first time I've done it - I hope what I said was okay!
3.1.3 is released. Let's just go to that. If I can get 2 postive builds from you two, I'll bump devel and have it pulled through since it is a security issue.
Okay Eric, I'll leave 3.1.3 compiling overnight and let you know if it worked in the morning (9:00ish GMT ;))
heh, well, I patched it anyways... need to check my email more often... it's in devel/test/stable now. It's good to not disturb the stable people too much anyways... But it's good that 3.1.3 is going in soon, my change just gives us a little bit more breathing room. I don't have time to compile all of kde right now though, maybe later. I'd say one good positive report is good enough to put it into devel and test, then after some more, put it in stable. I'm going to look at news.sourcemage.org now.
Right, I've compiled and installed all of these packages with no problems at all: arts 1.1.3 kdeutils 3.1.3 quanta 3.1.3 kdegraphics 3.1.3 kde-i18n 3.1.3 kdelibs 3.1.3 kdemultimedia 3.1.3 kdenetwork 3.1.3 kdeaddons 3.1.3 kdepim 3.1.3 kdeadmin 3.1.3 kdeartwork 3.1.3 kdesdk 3.1.3 kdebase 3.1.3 The only changes I made to the spells was bumping the version numbers and other references to 3.1.2. For some reason kdeartwork was still at 3.1.1 which threw my little sed script at first! There are some remaining packages that I haven't tested. That's because I don't normally have them installed and so I didn't have any sources to patch up to 3.1.3. Downloading them over my 56k connection would have been a bit slow I'm afraid. These untested packages are: kdebindings kdeedu kdegames kdetoys If someone else with a faster connection could test those, that would be great :)
I am on it...
damn it i wanted to close these!