6.5
CVE-2020-13645
- EPSS 0.61%
- Published 28.05.2020 12:15:11
- Last modified 21.11.2024 05:01:40
- Source cve@mitre.org
- Teams watchlist Login
- Open Login
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.
Data is provided by the National Vulnerability Database (NVD)
Gnome ≫ Glib-networking Version < 2.62.4
Gnome ≫ Glib-networking Version >= 2.64.0 < 2.64.3
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version19.10
Canonical ≫ Ubuntu Linux Version20.04 SwEditionlts
Fedoraproject ≫ Fedora Version31
Fedoraproject ≫ Fedora Version32
Netapp ≫ Cloud Backup Version-
Broadcom ≫ Fabric Operating System Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.61% | 0.69 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 3.9 | 2.5 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
|
| nvd@nist.gov | 6.4 | 10 | 4.9 |
AV:N/AC:L/Au:N/C:P/I:P/A:N
|
CWE-295 Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.