CVE-2020-13645
Medium
Description
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Gnome Balsa
PublishedMay 28, 2020
First seenMay 28, 2020
How to fix
Update
- gnome balsa2.5.11 or later
- gnome glib-networking2.62.4, 2.64.3 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQEQJQ4XFMFCFJTEXKL2ZO3UELBPCKSK/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLEX2IP62SU6WJ4SK3U766XGLQK3J62O/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LRCUM22YEWWKNMN2BP5LTVDM5P4VWIXS/
- usn.ubuntu.com/4405-1/
- security.gentoo.org/glsa/202007-50
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gnome balsa | v < 2.5.11, 2.6.0 | 2.5.11 |
| gnome glib-networking | v < 2.62.4, 2.64.0 ≤ v < 2.64.3 | 2.62.4, 2.64.3 |
| canonical ubuntu_linux | 16.04, 18.04, 19.10, 20.04 | — |
| fedoraproject fedora | 31, 32 | — |
| netapp cloud_backup | No range specified | — |
| broadcom fabric_operating_system | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.