CVE-2024-36048

Name	CVE-2024-36048
Description	QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1071973, 1071974

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
qt6-networkauth (PTS)	bookworm	6.4.2-1	vulnerable
	sid, trixie	6.7.2-2	fixed
qtnetworkauth-everywhere-src (PTS)	bullseye	5.15.2-2	vulnerable
	bookworm	5.15.8-2	vulnerable
	sid, trixie	5.15.15-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
qt6-networkauth	source	(unstable)	6.7.2-2			1071973
qtnetworkauth-everywhere-src	source	(unstable)	5.15.13-3			1071974

Notes

[bookworm] - qtnetworkauth-everywhere-src <ignored> (Minor issue)
[bullseye] - qtnetworkauth-everywhere-src <no-dsa> (Minor issue)
[buster] - qtnetworkauth-everywhere-src <postponed> (Minor issue)
[bookworm] - qt6-networkauth <ignored> (Minor issue)
https://codereview.qt-project.org/c/qt/qtnetworkauth/+/560317 (security fix)
https://codereview.qt-project.org/c/qt/qtnetworkauth/+/560368 (followup/finetuning)