CVE-2026-35207 deepinid plugin in dde-control-center is configured to skip TLS certificate verification when downloading avatar from remote server

[
  {
    "vendor": "linuxdeepin",
    "product": "dde-control-center",
    "versions": [
      {
        "version": ">= 6.1.35, < 6.1.80",
        "status": "affected"
      },
      {
        "version": ">= 5.5.3, < 5.9.9",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "linuxdeepin",
    "product": "deepin-deepinid-plugin",
    "versions": [
      {
        "version": ">= 2.0.1, <= 2.0.9",
        "status": "affected"
      }
    ]
  }
]