CVE-2012-2132

2012-08-2000:00:00

ubuntu.com

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS

0.006

Percentile

78.6%

JSON

libsoup 2.32.2 and earlier does not validate certificates or clear the
trust flag when the ssl-ca-file does not exist, which allows remote
attackers to bypass authentication by connecting with a SSL connection.

Bugs

Notes

Author	Note
mdeslaur	This isn’t actually a flaw in libsoup, it’s a flaw in applications that don’t set ssl-strict, and don’t set ssl-ca-file, but expect SOUP_MESSAGE_CERTIFICATE_TRUSTED to mean something. Applications should either set a ssl-ca-file, or ignore SOUP_MESSAGE_CERTIFICATE_TRUSTED. We aren’t going to fix this in libsoup. Applications should be fixed instead. Marked as ignored.