Qt 6.11 is out! See what's new in the release
blog
CVEs Detected in Qt 6.10.2 by Mend (Whitesource) scan
-
I recently used Mend to scan Qt version 6.10.2 for vulnerabilities, the scan flagged over 200 vulnerabilities, including...
QT 6.10.2 (CVE-2023-2804)
minimatch (CVE-2022-3517)
Loadash-es (CVE-2020-28500)
qs (CVE-2026-2391)
body-parser (CVE-2024-45590)
karma (CVE-2022-0437)
and so on..I would like to understand how Qt addresses such issues and what actions, if any, should be taken.
- Are there plans to patch or update these affected third-party libraries in future Qt releases?
- What is Qt’s policy for monitoring and addressing CVEs discovered in third-party dependencies?
- Do we have guidance on above said few components for example, are included in the runtime distribution of Qt, or are they only used during build or testing?
- Are there any temporary mitigations or workarounds we should apply while waiting for official updates?
- Is it safe to remove or replace these components with patched versions of them without breaking Qt’s functionality?
Any information would be greatly appreciated
-
Hi and welcome to devnet,
AFAIK:- Vulnerabilities are treated seriously and patched. Note that sometimes, the vulnerability might be in a part not included within Qt's sources in which case it might not necessarily make sense to patch the included urgently.
- CVE's are monitored and dependencies are updated
- I am not sure to understand what you mean there
- If the issue affects you directly, I would say build the module/plugin you need the patch for
- Remove ? How would you do that ? As with any replacement, you need to test.
How did you run the scan ?
Typically on Linux distributions, Qt is built against system librairies rather than the ones embedded so you might be getting these flagged.
