Non évaluée
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the...
CVE-2020-13645
Première détection SecPulse
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2020-13645 glib-networking Corrigé dans: 2.64.3-2
Description d'origine La description telle que publiée par la source (souvent en anglais).
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.
Références
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory usn.ubuntu.com
- report gitlab.gnome.org
- report gitlab.gnome.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org