In GNOME glib-networking through 2.64.2 the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior to fail the certificate verification. Applications that fail to provide the server identity including Balsa before 2.5.11 and 2.6.x before 2.6.1 accept a TLS certificate if the certificate is valid for any host.

🗓️ 18 Aug 2020 07:00:00Reported by MicrosoftType

In glib-networking 2.64.2 may skip hostname verification if server identity is not provided.

Reporter	Title	Published	Views	Family All 82
AlpineLinux	CVE-2020-13645	28 May 202011:55	–	alpinelinux
CBLMariner	CVE-2020-13645 affecting package glib-networking 2.59.1-7	8 Oct 202018:09	–	cbl_mariner
CBLMariner	CVE-2020-13645 affecting package glib-networking for versions less than 2.59.1-8	9 Apr 202206:51	–	cbl_mariner
CNVD	GNOME glib-networking Trust Management Issues Vulnerability	29 May 202000:00	–	cnvd
CVE	CVE-2020-13645	28 May 202011:55	–	cve
Cvelist	CVE-2020-13645	28 May 202011:55	–	cvelist
Debian CVE	CVE-2020-13645	28 May 202011:55	–	debiancve
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.2.0 : glib-networking (EulerOS-SA-2020-1975)	8 Sep 202000:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP5 : glib-networking (EulerOS-SA-2020-2246)	30 Oct 202000:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP2 : glib-networking (EulerOS-SA-2020-2346)	3 Nov 202000:00	–	nessus