medium
6.5
CWE
295
Advisory Published
CVE Published
Updated

CVE-2020-13645

First published: Thu May 28 2020(Updated: )

In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.

Credit: cve@mitre.org cve@mitre.org

Affected SoftwareAffected VersionHow to fix
GNOME Balsa<2.5.11
GNOME Balsa=2.6.0
GNOME glib-networking<2.62.4
GNOME glib-networking>=2.64.0<2.64.3
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=19.10
Canonical Ubuntu Linux=20.04
Fedoraproject Fedora=31
Fedoraproject Fedora=32
Netapp Cloud Backup
Broadcom Fabric Operating System
ubuntu/balsa<2.5.6-2ubuntu0.1
2.5.6-2ubuntu0.1
ubuntu/balsa<2.6.0-2ubuntu0.1
2.6.0-2ubuntu0.1
ubuntu/glib-networking<2.56.0-1ubuntu0.1
2.56.0-1ubuntu0.1
ubuntu/glib-networking<2.62.1-1ubuntu0.1
2.62.1-1ubuntu0.1
ubuntu/glib-networking<2.64.2-1ubuntu0.1
2.64.2-1ubuntu0.1
ubuntu/glib-networking<2.48.2-1~ubuntu16.04.2
2.48.2-1~ubuntu16.04.2
debian/glib-networking
2.66.0-2
2.74.0-4
2.80.0-1

Remedy

https://gitlab.gnome.org/GNOME/balsa/-/commit/e8952e3ccb1bb5094a6f8920e7c274e2e7dae184

Remedy

https://gitlab.gnome.org/GNOME/glib-networking/-/commit/29513946809590c4912550f6f8620468f9836d94

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is CVE-2020-13645?

    CVE-2020-13645 is a vulnerability in GNOME glib-networking through 2.64.2 that allows the skipping of hostname verification of the server's TLS certificate.

  • How severe is CVE-2020-13645?

    CVE-2020-13645 has a severity rating of medium (6.5).

  • How does CVE-2020-13645 affect glib-networking?

    CVE-2020-13645 affects glib-networking versions up to and including 2.64.2.

  • How can I fix CVE-2020-13645?

    To fix CVE-2020-13645, upgrade to glib-networking version 2.64.3 or later.

  • Are there any references for CVE-2020-13645?

    Yes, you can find references for CVE-2020-13645 at the following links: [Link 1](https://gitlab.gnome.org/GNOME/balsa/-/issues/34), [Link 2](https://gitlab.gnome.org/GNOME/glib-networking/-/issues/135), [Link 3](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HLEX2IP62SU6WJ4SK3U766XGLQK3J62O/)

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203