CVE-2021-39365

CVE-2021-39365 affects GNOME Grilo with TLS certificate verification disabled on SoupSessionAsync/SoupSessionSync (grl-net-wc.c). Connected advisories show mitigations via upgraded Grilo packages in several distros (e.g., Debian bullseye 0.3.13-1+deb11u1; Mageia updates; AlmaLinux ALAS2 advisorie...

CVE-2021-39365

In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011...

Gitlab Grilo信任管理问题漏洞

Gitlab Grilo is a framework for browsing and searching media content from a variety of sources using a single API. A security vulnerability exists in GNOME grilo 0.3.13 and earlier versions, which stems from the program grl-net-wc.c not enabling TLS certificate validation on the SoupSessionAsync...

PT-2021-22568 · Gnome +8 · Gnome Grilo +8

Name of the Vulnerable Software and Affected Versions: GNOME grilo versions prior to 0.3.14 Description: The issue is related to the lack of TLS certificate verification in the SoupSessionAsync objects created by grl-net-wc.c, making users susceptible to network man-in-the-middle MITM attacks...

PackageKit, accountsservice, adwaita, appstream, at, atk, baobab, bolt, brasero, cairo, cheese, clutter, compat, control, dconf, devhelp, ekiga, empathy, eog, evince, evolution, file, flatpak, folks, fontconfig, freetype, fribidi, fwupd, fwupdate, gcr, gdk, gdm, gedit, geoclue2, geocode, gjs, glade, glib, glib2, glibmm24, gnome, gnote, gobject, gom, google, grilo, gsettings, gspell, gssdp, gstreamer1, gtk, gtk3, gtksourceview3, gucharmap, gupnp, gvfs, harfbuzz, json, libappstream, libchamplain, libcroco, libgdata, libgee, libgepub, libgexiv2, libgnomekbd, libgovirt, libgtop2, libgweather, libgxps, libical, libmediaart, libosinfo, libpeas, librsvg2, libsecret, libsoup, libwayland, libwnck3, mozjs52, mutter, nautilus, openchange, osinfo, pango, poppler, python2, rest, rhythmbox, seahorse, shotwell, sushi, totem, upower, vala, valadoc, vino, vte, vte291, wayland, webkitgtk4, xdg, yelp, zenity security update

CentOS Errata and Security Advisory CESA-2018:3140 An update is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...