CVE-2021-39365
First published: Sun Aug 22 2021(Updated: )
In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/grilo | <=0.3.13-1<=0.3.7-1 | 0.3.13-1+deb11u1 0.3.7-1+deb10u1 0.3.13-1.1 |
| GNOME grilo | <=0.3.13 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 | |
| debian/grilo | 0.3.7-1+deb10u1 0.3.13-1+deb11u1 0.3.15-1 0.3.16-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://gitlab.gnome.org/GNOME/grilo/-/issues/146
- https://security-tracker.debian.org/tracker/CVE-2021-39365
- https://security-tracker.debian.org/tracker/CVE-2016-20011
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39365
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=992971
- https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification/
- https://lists.debian.org/debian-lts-announce/2021/09/msg00010.html
- https://www.debian.org/security/2021/dsa-4964
Frequently Asked Questions
What is CVE-2021-39365?
CVE-2021-39365 is a vulnerability in GNOME grilo where grl-net-wc.c does not enable TLS certificate verification on SoupSessionAsync objects, leaving users vulnerable to network MITM attacks.
How does CVE-2021-39365 affect users?
CVE-2021-39365 affects users by leaving them vulnerable to network MITM attacks.
What is the severity of CVE-2021-39365?
CVE-2021-39365 has a severity rating of medium.
What is the affected software for CVE-2021-39365?
The affected software for CVE-2021-39365 includes GNOME grilo versions up to 0.3.13 and Debian Debian Linux versions 9.0, 10.0, and 11.0.
How can users fix CVE-2021-39365?
Users can fix CVE-2021-39365 by updating to the patched versions of GNOME grilo (0.3.13-1+deb11u1 or 0.3.7-1+deb10u1) or Debian Debian Linux (9.0, 10.0, or 11.0) using the provided remedies.
- collector/debian-bugs
- alias/CVE-2021-39365
- collector/nvd-index
- collector/security-tracker-debian
- package-manager/debian
- vendor/gnome
- canonical/gnome grilo
- version/gnome grilo/0.3.13
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0
- version/debian debian linux/11.0