Bug 1790288 (CVE-2020-6750)

Summary: CVE-2020-6750 glib: Mishandling of proxy_addr field in GSocketClient may lead to proxy being ignored
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: caillon+fedoraproject, erack, erik-fedora, fedora, fidencio, gecko-bugs-nobody, gnome-sig, jhorak, john.j5live, klember, manisandro, marcandre.lureau, mclasen, pahan, paul, rdieter, rh-spice-bugs, rhughes, rjones, rstrode, sandmann, stransky, tiagomatos, walters
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-01-14 12:28:41 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1790289, 1790866    
Bug Blocks: 1790291    

Description Pedro Sampaio 2020-01-13 02:59:35 UTC
GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. NOTE: versions before 2.60 are unaffected.

Upstream issue:




Comment 1 Pedro Sampaio 2020-01-13 03:00:05 UTC
Created mingw-glib2 tracking bugs for this issue:

Affects: epel-7 [bug 1790290]
Affects: fedora-all [bug 1790289]

Comment 2 Huzaifa S. Sidhpurwala 2020-01-14 12:22:10 UTC
Created glib2 tracking bugs for this issue:

Affects: fedora-all [bug 1790866]

Comment 3 Huzaifa S. Sidhpurwala 2020-01-14 12:28:46 UTC

As per upstream versions of glib2 before 2.60 are unaffected, therefore glib2 package shipped with Red Hat Products are not affected by this flaw.

Comment 5 msiddiqu 2020-02-11 09:06:07 UTC
Upstream merge request: