Description
libgdata before 0.10.2 and 0.11.x before 0.11.1 does not validate SSL certificates, which allows remote attackers to obtain user names and passwords via a man-in-the-middle (MITM) attack with a spoofed certificate.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | libgdata | 0.10.2-1 | — |
| Debian 12 | libgdata | 0.10.2-1 | — |
| Debian 6.0 | libgdata | 0.6.4-2+squeeze1 | DSA-2482-1 |
Advisories 1
- DSA-2482-1 libgdata - no verification of TLS certificates against system root CA Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://git.gnome.org/browse/libgdata/commit/?h=libgdata-0-10&id=8eff8fa9138859e03e58c2aa76600ab63eb5c29c
- https://bugzilla.novell.com/show_bug.cgi?id=752088
- [oss-security] 20120314 Re: CVE Request: libgdata did not verify SSL certificates mailing-list
- [oss-security] 20120314 CVE Request: libgdata did not verify SSL certificates mailing-list
- DSA-2482 vendor-advisory
- MDVSA-2012:111 vendor-advisory
- https://bugs.launchpad.net/ubuntu/+source/libgdata/+bug/938812
- https://bugzilla.gnome.org/show_bug.cgi?id=671535
- http://git.gnome.org/browse/libgdata/commit/?id=6799f2c525a584dc998821a6ce897e463dad7840
- [oss-security] 20120314 Re: CVE Request: libgdata did not verify SSL certificates mailing-list
- 50432 third-party-advisory
- USN-1547-1 vendor-advisory