Vulnerability Description
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gnome | Balsa | < 2.5.11 |
| Gnome | Glib-Networking | < 2.62.4 |
| Canonical | Ubuntu Linux | 16.04 |
| Fedoraproject | Fedora | 31 |
| Netapp | Cloud Backup | - |
| Broadcom | Fabric Operating System | - |
Related Weaknesses (CWE)
References
- https://gitlab.gnome.org/GNOME/balsa/-/issues/34ExploitVendor Advisory
- https://gitlab.gnome.org/GNOME/glib-networking/-/issues/135ExploitVendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202007-50Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200608-0004/Third Party Advisory
- https://usn.ubuntu.com/4405-1/Third Party Advisory
- https://gitlab.gnome.org/GNOME/balsa/-/issues/34ExploitVendor Advisory
- https://gitlab.gnome.org/GNOME/glib-networking/-/issues/135ExploitVendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202007-50Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200608-0004/Third Party Advisory
FAQ
What is CVE-2020-13645?
CVE-2020-13645 is a vulnerability with a CVSS score of 6.5 (MEDIUM). In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server ...
How severe is CVE-2020-13645?
CVE-2020-13645 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-13645?
Check the references section above for vendor advisories and patch information. Affected products include: Gnome Balsa, Gnome Glib-Networking, Canonical Ubuntu Linux, Fedoraproject Fedora, Netapp Cloud Backup.