CVE-2013-1799

2013-02-0500:00:00

ubuntu.com

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS

0.003

Percentile

68.0%

JSON

Gnome Online Accounts (GOA) 3.6.x before 3.6.3 and 3.7.x before 3.7.91,
does not properly validate SSL certificates when creating accounts for
providers who use the libsoup library, which allows man-in-the-middle
attackers to obtain sensitive information such as credentials by sniffing
the network. NOTE: this issue exists because of an incomplete fix for
CVE-2013-0240.

Notes

Author	Note
mdeslaur	CVE-2013-1799 is a result of an incomplete fix for CVE-2013-0240

OSVersionArchitecturePackageVersionFilename
ubuntu11.10noarchgnome-online-accounts< 3.2.1-0ubuntu1.1UNKNOWN
ubuntu12.04noarchgnome-online-accounts< 3.4.0-0ubuntu1.1UNKNOWN
ubuntu12.10noarchgnome-online-accounts< 3.6.0-0ubuntu1.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	11.10	noarch	gnome-online-accounts	< 3.2.1-0ubuntu1.1	UNKNOWN
ubuntu	12.04	noarch	gnome-online-accounts	< 3.4.0-0ubuntu1.1	UNKNOWN
ubuntu	12.10	noarch	gnome-online-accounts	< 3.6.0-0ubuntu1.1	UNKNOWN