6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
In GNOME glib-networking is vulnerable to man-in-the-middle attack. GTlsClientConnection of the library skips hostname verification of the server’s TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, accept a TLS certificate if the certificate is valid for any host.
CPE | Name | Operator | Version |
---|---|---|---|
glib-networking:edge | eq | 2.64.2-r0 | |
glib-networking:edge | eq | 2.62.3-r3 | |
glib-networking:edge | eq | 2.64.0-r0 | |
glib-networking:edge | eq | 2.64.1-r0 |
gitlab.gnome.org/GNOME/balsa/-/issues/34
gitlab.gnome.org/GNOME/glib-networking/-/issues/135
lists.fedoraproject.org/archives/list/[email protected]/message/HLEX2IP62SU6WJ4SK3U766XGLQK3J62O/
lists.fedoraproject.org/archives/list/[email protected]/message/LRCUM22YEWWKNMN2BP5LTVDM5P4VWIXS/
lists.fedoraproject.org/archives/list/[email protected]/message/TQEQJQ4XFMFCFJTEXKL2ZO3UELBPCKSK/
secdb.alpinelinux.org/edge/community.yaml
secdb.alpinelinux.org/v3.12/community.yaml
secdb.alpinelinux.org/v3.13/community.yaml
security.gentoo.org/glsa/202007-50
security.netapp.com/advisory/ntap-20200608-0004/
usn.ubuntu.com/4405-1/
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N