CVE-2021-39365: Medium severity Gnome grilo vulnerability
In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/griloto a version that resolves this vulnerability.Fixed in 0.3.13-1+deb11u1Fixed in 0.3.7-1+deb10u1Fixed in 0.3.13-1.1 - Upgrade
Upgrade
debian/griloto a version that resolves this vulnerability.Fixed in 0.3.7-1+deb10u1Fixed in 0.3.13-1+deb11u1Fixed in 0.3.15-1Fixed in 0.3.16-1
Event History
Frequently Asked Questions
What is CVE-2021-39365?
CVE-2021-39365 is a vulnerability in GNOME grilo where grl-net-wc.c does not enable TLS certificate verification on SoupSessionAsync objects, leaving users vulnerable to network MITM attacks.
How does CVE-2021-39365 affect users?
CVE-2021-39365 affects users by leaving them vulnerable to network MITM attacks.
What is the severity of CVE-2021-39365?
CVE-2021-39365 has a severity rating of medium.
What is the affected software for CVE-2021-39365?
The affected software for CVE-2021-39365 includes GNOME grilo versions up to 0.3.13 and Debian Debian Linux versions 9.0, 10.0, and 11.0.
How can users fix CVE-2021-39365?
Users can fix CVE-2021-39365 by updating to the patched versions of GNOME grilo (0.3.13-1+deb11u1 or 0.3.7-1+deb10u1) or Debian Debian Linux (9.0, 10.0, or 11.0) using the provided remedies.