USN-4405-1: GLib Networking vulnerability
It was discovered that glib-networking skipped hostname certificate verification if the application failed to specify the server identity. A remote attacker could use this to perform a person-in-the-middle attack and expose sensitive information.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this advisory?
The vulnerability ID of this advisory is USN-4405-1.
What is the title of this advisory?
The title of this advisory is USN-4405-1: GLib Networking vulnerability.
What is the description of this vulnerability?
This vulnerability allows a remote attacker to perform a person-in-the-middle attack and expose sensitive information by exploiting a flaw in glib-networking that skips hostname certificate verification.
Which software is affected by this vulnerability?
The affected software is glib-networking version 2.64.2-1ubuntu0.1 on Ubuntu 20.04, version 2.62.1-1ubuntu0.1 on Ubuntu 19.10, version 2.56.0-1ubuntu0.1 on Ubuntu 18.04, and version 2.48.2-1~ubuntu16.04.2 on Ubuntu 16.04.
How can this vulnerability be remediated?
To remediate this vulnerability, it is recommended to upgrade glib-networking to the corresponding fixed versions: 2.64.2-1ubuntu0.1 for Ubuntu 20.04, 2.62.1-1ubuntu0.1 for Ubuntu 19.10, 2.56.0-1ubuntu0.1 for Ubuntu 18.04, and 2.48.2-1~ubuntu16.04.2 for Ubuntu 16.04.