CVE-2020-13645
Summary
| CVE | CVE-2020-13645 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-05-28 12:15:00 UTC |
|---|
| Updated | 2023-11-07 03:16:00 UTC |
|---|
| Description | In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| [SECURITY] Fedora 31 Update: glib-networking-2.62.4-1.fc31 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
Mailing List, Third Party Advisory |
| [SECURITY] Fedora 31 Update: mingw-glib-networking-2.62.4-1.fc31 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 31 Update: glib-networking-2.62.4-1.fc31 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| USN-4405-1: GLib Networking vulnerability | Ubuntu security notices | Ubuntu |
UBUNTU |
usn.ubuntu.com |
Third Party Advisory |
| GTlsClientConnection warning about NULL server-identity property (#34) · Issues · GNOME / balsa · GitLab |
MISC |
gitlab.gnome.org |
Exploit, Vendor Advisory |
| [SECURITY] Fedora 32 Update: mingw-glib-networking-2.64.3-1.fc32 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
Mailing List, Third Party Advisory |
| [SECURITY] Fedora 32 Update: mingw-glib-networking-2.64.3-1.fc32 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| CVE-2020-13645 GNOME GLib Vulnerability in NetApp Products | NetApp Product Security |
CONFIRM |
security.netapp.com |
Third Party Advisory |
| GLib Networking: Improper certificate validation (GLSA 202007-50) — Gentoo security |
GENTOO |
security.gentoo.org |
Third Party Advisory |
| [SECURITY] Fedora 31 Update: mingw-glib-networking-2.62.4-1.fc31 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
Mailing List, Third Party Advisory |
| (CVE-2020-13645) GTlsClientConnection silently ignores unset server identity (#135) · Issues · GNOME / glib-networking · GitLab |
MISC |
gitlab.gnome.org |
Exploit, Vendor Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 296073 Oracle Solaris 11.4 Support Repository Update (SRU) 24.75.2 Missing (CPUJUL2020)
- 500970 Alpine Linux Security Update for glib-networking
- 670486 EulerOS Security Update for glib-networking (EulerOS-SA-2021-2244)
- 670512 EulerOS Security Update for glib-networking (EulerOS-SA-2021-2270)
- 750924 OpenSUSE Security Update for balsa (openSUSE-SU-2021:1094-1)
- 751458 OpenSUSE Security Update for glib-networking (openSUSE-SU-2021:3944-1)
- 751478 SUSE Enterprise Linux Security Update for glib-networking (SUSE-SU-2021:3997-1)
- 751482 SUSE Enterprise Linux Security Update for glib-networking (SUSE-SU-2021:4004-1)
- 751520 OpenSUSE Security Update for glib-networking (openSUSE-SU-2021:1554-1)
- 900189 CBL-Mariner Linux Security Update for glib-networking 2.59.1
- 901195 Common Base Linux Mariner (CBL-Mariner) Security Update for glib-networking (6440-1)
- 903398 Common Base Linux Mariner (CBL-Mariner) Security Update for glib-networking (1945)
