GLib Networking: Improper certificate validation — GLSA 202007-50

GLib Networking was not properly verifying TLS certificates in all circumstances, possibly allowing an integrity/confidentiality compromise.

Affected packages

Background

Network-related giomodules for glib

Description

GTlsClientConnection skips hostname verification of the server’s TLS certificate if the application fails to specify the expected server identity.

Impact

There may be a breach of integrity or confidentiality in connections made using GLib Networking.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-libs/glib-networking-2.62.4"
 

References

• CVE-2020-13645

Release date
July 27, 2020

Latest revision
July 27, 2020: 1

Severity
normal

Exploitable
remote

Bugzilla entries

• 725880