CVE-2020-13645
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity.
Does this matter?
Lower severity and a low EPSS score (1.97%). Track it; it rarely justifies an emergency change on its own.
Description
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- EPSS
- 1.97% probability · 79th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-295
- Affected
- gnome/balsa · gnome/glib-networking · canonical/ubuntu linux · fedoraproject/fedora · netapp/cloud backup · broadcom/fabric operating system
- Source
- cve@mitre.org
References
- https://gitlab.gnome.org/GNOME/balsa/-/issues/34Exploit, Vendor Advisory
- https://gitlab.gnome.org/GNOME/glib-networking/-/issues/135Exploit, Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLEX2IP62SU6WJ4SK3U766XGLQK3J62O/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LRCUM22YEWWKNMN2BP5LTVDM5P4VWIXS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQEQJQ4XFMFCFJTEXKL2ZO3UELBPCKSK/
- https://security.gentoo.org/glsa/202007-50Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200608-0004/Third Party Advisory
- https://usn.ubuntu.com/4405-1/Third Party Advisory
- https://gitlab.gnome.org/GNOME/balsa/-/issues/34Exploit, Vendor Advisory
- https://gitlab.gnome.org/GNOME/glib-networking/-/issues/135Exploit, Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLEX2IP62SU6WJ4SK3U766XGLQK3J62O/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LRCUM22YEWWKNMN2BP5LTVDM5P4VWIXS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQEQJQ4XFMFCFJTEXKL2ZO3UELBPCKSK/
- https://security.gentoo.org/glsa/202007-50Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200608-0004/Third Party Advisory
- https://usn.ubuntu.com/4405-1/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.