Summary
It was discovered that glib-networking skipped hostname certificate
verification if the application failed to specify the server
identity. A remote attacker could use this to perform a
person-in-the-middle attack and expose sensitive information.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | glib-networking | 2.48.2-1~ubuntu16.04.2 |
| Ubuntu · 18.04 LTS 18.04:LTS | glib-networking | 2.56.0-1ubuntu0.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | glib-networking | 2.64.2-1ubuntu0.1 |
Vulnerabilities 1
-
Unscored —
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the …
References
-
report
https://ubuntu.com/security/CVE-2020-13645