Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package qt6-websockets for openSUSE:Factory
checked in at 2026-11-08 19:21:24
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/qt6-websockets (Old)
and /work/SRC/openSUSE:Factory/.qt6-websockets.new.3759290 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "qt6-websockets"
Sun Nov 8 19:21:24 2026 rev:38 rq:1395858 version:6.12.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/qt6-websockets/qt6-websockets.changes
2026-10-18 19:22:02.949589091 +0200
+++
/work/SRC/openSUSE:Factory/.qt6-websockets.new.3759290/qt6-websockets.changes
2026-11-08 19:21:31.689745157 +0100
@@ -1,0 +2,6 @@
+Fri Nov 6 13:48:42 UTC 2026 - Christophe Marin <[email protected]>
+
+- Add upstream change (CVE-2026-114366)
+ * CVE-2026-114366.patch
+
+-------------------------------------------------------------------
New:
----
CVE-2026-114366.patch
----------(New B)----------
New:- Add upstream change (CVE-2026-114366)
* CVE-2026-114366.patch
----------(New E)----------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ qt6-websockets.spec ++++++
--- /var/tmp/diff_new_pack.JSWoth/_old 2026-11-08 19:21:32.666785575 +0100
+++ /var/tmp/diff_new_pack.JSWoth/_new 2026-11-08 19:21:32.667785616 +0100
@@ -34,6 +34,8 @@
URL: https://www.qt.io
Source0:
https://download.qt.io/official_releases/qt/%{short_version}/%{real_version}%{tar_suffix}/submodules/%{tar_name}-%{real_version}%{tar_suffix}.tar.xz
Source99: qt6-websockets-rpmlintrc
+# PATCH-FIX-UPSTREAM
+Patch0: CVE-2026-114366.patch
BuildRequires: pkgconfig
BuildRequires: cmake(Qt6Core) = %{real_version}
BuildRequires: cmake(Qt6CorePrivate) = %{real_version}
++++++ CVE-2026-114366.patch ++++++
>From 4dc012ee1d7158c214998ae21e96e25b40a9c42b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A5rten=20Nordheim?= <[email protected]>
Date: Fri, 18 Sep 2026 12:33:19 +0200
Subject: [PATCH] QWebSocket: fix auth state not being cleared
When reusing a QWebSocket object we could end up, depending
on the state, retaining some data that would then be used
in the next connection.
Fixes: QTBUG-150542
Pick-to: 6.12.0 6.11 6.11.3 6.8
Change-Id: I1fd557044a85ca2bae6db37800c68198dbb5b82e
Reviewed-by: Edward Welbourne <[email protected]>
(cherry picked from commit 98249844fa4297b206620a98d369147d79910756)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
---
src/websockets/qwebsocket_p.cpp | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/src/websockets/qwebsocket_p.cpp b/src/websockets/qwebsocket_p.cpp
index 7176d7e..bae2008 100644
--- a/src/websockets/qwebsocket_p.cpp
+++ b/src/websockets/qwebsocket_p.cpp
@@ -419,6 +419,11 @@ void QWebSocketPrivate::open(const QNetworkRequest
&request,
m_isClosingHandshakeReceived = false;
m_isClosingHandshakeSent = false;
+ m_authenticator = QAuthenticator();
+ m_bytesToSkipBeforeNewResponse = 0;
+ m_needsResendWithCredentials = false;
+ m_needsReconnect = false;
+
setRequest(request, options);
if (url.path().isEmpty())
url.setPath(QStringLiteral("/"));
--
2.56.0
