NuytsTech Security

CVE-2021-39365

by ·

In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.

Date published : 2021-08-22

https://www.debian.org/security/2021/dsa-4964

Reminder: SoupSessionSync and SoupSessionAsync default to no TLS certificate verification

Tags: