It was found that previously libgdata, a GLib-based library for accessing online service APIs using the GData protocol, did not perform SSL certificates validation even for secured connections. An application, linked against the libgdata library and holding the trust about the other side of the connection being the valid owner of the certificate, could be tricked into accepting of a spoofed SSL certificate by mistake (MITM attack). Upstream bug report: [1] https://bugzilla.gnome.org/show_bug.cgi?id=671535 (private) Upstream patches: [2] http://git.gnome.org/browse/libgdata/commit/?id=6799f2c525a584dc998821a6ce897e463dad7840 [3] http://git.gnome.org/browse/libgdata/commit/?h=libgdata-0-10&id=8eff8fa9138859e03e58c2aa76600ab63eb5c29c CVE request: [4] http://www.openwall.com/lists/oss-security/2012/03/14/1 Other references: [5] https://bugzilla.novell.com/show_bug.cgi?id=752088 (private) [6] https://bugs.launchpad.net/ubuntu/+source/libgdata/+bug/938812 Credit: Issue originally reported by Vreixo Formoso.
This issue affects the version of the libgdata package, as shipped with Red Hat Enterprise Linux 6. -- This issue affects the versions of the libgdata package, as shipped with Fedora release of 15 and 16. Please schedule an update.
Created libgdata tracking bugs for this issue Affects: fedora-all [bug 803337]
This was assigned the name CVE-2012-1177: http://www.openwall.com/lists/oss-security/2012/03/14/8