CVE-2020-13962

Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails. (Mumble 1.3.1 is not affected, regardless of the Qt version.)

Affected products

Alt Linux, Almalinux, Centos, Linuxmint, Openssl, Qt, Red Hat, Rocky Linux

Mumble

= 1.3.0

Qt

< 5.12.9, 5.13.2, 5.14.2

CVSS 3.1

7.5 HIGH

EPSS

3.0% (86th percentile)

NVD status

Modified

Published

2020-06-08

No exploit for CVE-2020-13962 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.