Skip to content
OpenAdvisories
Medium ALAS2-2023-2306 1 CVE

Moderate: grilo security update (Amazon Linux 2)

Published Oct 12, 2023 · Updated Oct 19, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-39365: In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 grilo 0:0.3.6-1.amzn2.0.1
Amazon Linux · 2 grilo-debuginfo 0:0.3.6-1.amzn2.0.1
Amazon Linux · 2 grilo-devel 0:0.3.6-1.amzn2.0.1

Vulnerabilities 1

  • Unscored —
    CVE-2021-39365

    In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects…

    grilo grilo Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-39365.html