In GNOME glib-networking is vulnerable to man-in-the-middle attack. GTlsClientConnection of the library skips hostname verification of the server’s TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, accept a TLS certificate if the certificate is valid for any host.
CPE | Name | Operator | Version |
---|---|---|---|
glib-networking:edge | eq | 2.64.2-r0 | |
glib-networking:edge | eq | 2.62.3-r3 | |
glib-networking:edge | eq | 2.64.0-r0 | |
glib-networking:edge | eq | 2.64.1-r0 |
gitlab.gnome.org/GNOME/balsa/-/issues/34
gitlab.gnome.org/GNOME/glib-networking/-/issues/135
lists.fedoraproject.org/archives/list/[email protected]/message/HLEX2IP62SU6WJ4SK3U766XGLQK3J62O/
lists.fedoraproject.org/archives/list/[email protected]/message/LRCUM22YEWWKNMN2BP5LTVDM5P4VWIXS/
lists.fedoraproject.org/archives/list/[email protected]/message/TQEQJQ4XFMFCFJTEXKL2ZO3UELBPCKSK/
secdb.alpinelinux.org/edge/community.yaml
secdb.alpinelinux.org/v3.12/community.yaml
secdb.alpinelinux.org/v3.13/community.yaml
security.gentoo.org/glsa/202007-50
security.netapp.com/advisory/ntap-20200608-0004/
usn.ubuntu.com/4405-1/