Bug 1842645 (CVE-2020-13645) - CVE-2020-13645 glib-networking: GTlsClientConnection silently ignores unset server identity
Summary: CVE-2020-13645 glib-networking: GTlsClientConnection silently ignores unset s...
Keywords:
Status: NEW
Alias: CVE-2020-13645
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 1842646 1842647 1844306 1844307
Blocks: 1842648
TreeView+ depends on / blocked
 
Reported: 2020-06-01 18:55 UTC by Guilherme de Almeida Suckevicz
Modified: 2024-03-06 18:02 UTC (History)
8 users (show)

Fixed In Version: glib-networking 2.62.4
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2020-06-01 18:55:19 UTC 
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.

References:
https://gitlab.gnome.org/GNOME/balsa/-/issues/34
https://gitlab.gnome.org/GNOME/glib-networking/-/issues/135
Comment 1 Guilherme de Almeida Suckevicz 2020-06-01 18:55:39 UTC 
Created glib-networking tracking bugs for this issue:

Affects: fedora-all [bug 1842646]


Created mingw-glib-networking tracking bugs for this issue:

Affects: fedora-all [bug 1842647]
Comment 2 Huzaifa S. Sidhpurwala 2020-06-05 03:19:36 UTC 
Upstream patch: https://gitlab.gnome.org/GNOME/glib-networking/-/commit/29513946809590c4912550f6f8620468f9836d94
Note You need to log in before you can comment on or make changes to this bug.