Bug 1296263 – Security issue in Nuvola Player 2 - no SSL certificate verification

Bug 1296263 - Security issue in Nuvola Player 2 - no SSL certificate verification

Summary:	Security issue in Nuvola Player 2 - no SSL certificate verification

Status:	CLOSED WONTFIX

Aliases:	None

Product:	Fedora
Classification:	Fedora
Component:	nuvolaplayer (Show other bugs)
Sub Component:
Version:	23
Hardware:	Unspecified Unspecified

Priority	unspecified Severity unspecified
Target Milestone:	---
Target Release:	---
Assigned To:	MartinKG
QA Contact:	Fedora Extras Quality Assurance
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2016-01-06 13:24 EST by Jiří Janoušek
Modified:	2016-09-21 14:51 EDT (History)
CC List:	1 user (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2016-09-21 14:51:48 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Jiří Janoušek 2016-01-06 13:24:10 EST

WebKitGTK+ library, used by Nuvola Player 2, comes with a disabled validation of SSL certificates by default. Since Nuvola Player 2 doesn't explicitly turn certificate verification on, it is vulnerable to Man in the middle attack, which may result in a theft of passwords to streaming services or linked third-party accounts (e.g. Facebook if the "Login with Facebook" feature has been used). Nuvola Player team recommends upgrading to Nuvola Player 3, which is not affected by this issue.

Affected versions: All Nuvola Player 2 releases
Fixed in: Nuvola Player 3

Note You need to log in before you can comment on or make changes to this bug.