Skip to content

qt5.qtwebengine: mark vulnerable #435067

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fabianhjr merged 4 commits into from
Aug 25, 2025
Merged

qt5.qtwebengine: mark vulnerable #435067

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5ebd24d
subsurface: fix build, remove vulnerable qtwebengine
LordGrimmauld Aug 19, 2025
45ed32f
supercollider: disable vulnerable qtwebengine by default
LordGrimmauld Aug 19, 2025
fdaf9ac
python312Packages.pyside2: disable vulnerable qtwebengine by default
LordGrimmauld Aug 19, 2025
d89ab7f
qt5.qtwebengine: mark vulnerable
LordGrimmauld Aug 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions pkgs/applications/misc/subsurface/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@
qtlocation,
qtsvg,
qttools,
qtwebengine,
Copy link
Contributor

@mguentner mguentner Aug 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 from my side

The impact should be rather small. According to subsurface's CMakeLists.txt, this should only disable the internal manual and printing support.

We can re-enable qtwebengine once subsurface builds with recent Qt 6 versions.

Copy link
Contributor Author

@LordGrimmauld LordGrimmauld Aug 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

on the version we have, qtwebengine is not used at all

Copy link
Contributor

@mguentner mguentner Aug 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Indeed, seems like the cmake cannot find it. This should be the code.

Copy link
Contributor Author

@LordGrimmauld LordGrimmauld Aug 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Careful: we are on commit 38a0050ac33566dfd34bf94cf1d7ac66034e4118, which only supports qtwebkit: https://github.com/subsurface/subsurface/blob/38a0050ac33566dfd34bf94cf1d7ac66034e4118/CMakeLists.txt#L249-L275

qtwebkit is the predecessor to qtwebengine, and even worse in terms of security, see e.g. https://blogs.gnome.org/mcatanzaro/2022/11/04/stop-using-qtwebkit/

qtwebengine is not supported at all for the version we have. Not even for qt6, where it is just blanket-disabled. We'd need to update the package to use a modern version and qt6 to make use of qtwebengine.

Copy link
Contributor

@mguentner mguentner Aug 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This commit is interesting :)

subsurface/subsurface@643f4a5

qtpositioning,
libXcomposite,
bluez,
writeScript,
Expand Down Expand Up @@ -142,7 +142,7 @@ stdenv.mkDerivation {
qtconnectivity
qtsvg
qttools
qtwebengine
qtpositioning
];

nativeBuildInputs = [
Expand Down
4 changes: 3 additions & 1 deletion pkgs/development/interpreters/supercollider/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@
supercolliderPlugins,
writeText,
runCommand,
withWebengine ? false, # vulnerable, so disabled by default
}:

mkDerivation rec {
Expand Down Expand Up @@ -64,17 +65,18 @@ mkDerivation rec {
curl
libXt
qtbase
qtwebengine
qtwebsockets
readline
]
++ lib.optional withWebengine qtwebengine
++ lib.optional (!stdenv.hostPlatform.isDarwin) alsa-lib;

hardeningDisable = [ "stackprotector" ];

cmakeFlags = [
"-DSC_WII=OFF"
"-DSC_EL=${if useSCEL then "ON" else "OFF"}"
(lib.cmakeBool "SC_USE_QTWEBENGINE" withWebengine)
];

passthru = {
Expand Down
37 changes: 37 additions & 0 deletions pkgs/development/libraries/qt-5/modules/qtwebengine.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -464,6 +464,43 @@ qtModule (

# This build takes a long time; particularly on slow architectures
timeout = 24 * 3600;

knownVulnerabilities = [
''
qt5 qtwebengine is unmaintained upstream since april 2025.
It is based on chromium 87.0.4280.144, and supposedly patched up to 135.0.7049.95 which is outdated.

Security issues are frequently discovered in chromium.
The following list of CVEs was fixed in the life cycle of chromium 138 and likely also affects qtwebengine:
- CVE-2025-8879
- CVE-2025-8880
- CVE-2025-8901
- CVE-2025-8881
- CVE-2025-8882
- CVE-2025-8576
- CVE-2025-8577
- CVE-2025-8578
- CVE-2025-8579
- CVE-2025-8580
- CVE-2025-8581
- CVE-2025-8582
- CVE-2025-8583
- CVE-2025-8292
- CVE-2025-8010
- CVE-2025-8011
- CVE-2025-7656
- CVE-2025-6558 (known to be exploited in the wild)
- CVE-2025-7657
- CVE-2025-6554
- CVE-2025-6555
- CVE-2025-6556
- CVE-2025-6557

The actual list of CVEs affecting qtwebengine is likely much longer,
as this list is missing issues fixed in chromium 136/137 and even more
issues are continuously discovered and lack upstream fixes in qtwebengine.
''
];
};

}
Expand Down
5 changes: 4 additions & 1 deletion pkgs/development/python-modules/pyside2/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
ninja,
qt5,
shiboken2,
withWebengine ? false, # vulnerable, so omit by default
}:
stdenv.mkDerivation rec {
pname = "pyside2";
Expand Down Expand Up @@ -67,13 +68,15 @@ stdenv.mkDerivation rec {
qtlocation
qtscript
qtwebsockets
qtwebengine
qtwebchannel
qtcharts
qtsensors
qtsvg
qt3d
])
++ lib.optionals withWebengine [
qt5.qtwebengine
]
++ (with python.pkgs; [ setuptools ])
++ (lib.optionals (python.pythonOlder "3.9") [
# see similar issue: 202262
Expand Down
Loading