CVE-2013-1799

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2013-1799
Gnome Online Accounts (GOA) 3.6.x before 3.6.3 and 3.7.x before 3.7.91, does not properly validate SSL certificates when creating accounts for providers who use the libsoup library, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network. NOTE: this issue exists because of an incomplete fix for CVE-2013-0240.

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://lists.opensuse.org/opensuse-updates/2013-02/msg00046.html
http://secunia.com/advisories/51976 Vendor Advisory
http://secunia.com/advisories/52791 Vendor Advisory
http://ubuntu.com/usn/usn-1779-1
https://bugzilla.gnome.org/show_bug.cgi?id=693214
https://bugzilla.gnome.org/show_bug.cgi?id=695106
https://git.gnome.org/browse/gnome-online-accounts/commit/?id=9cf4bc0ced2c53bcdd36922caa65afc8a167bbd8
https://mail.gnome.org/archives/gnome-announce-list/2013-March/msg00007.html
https://mail.gnome.org/archives/gnome-announce-list/2013-March/msg00020.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gnome:gnome_online_accounts:3.6.0:*:*:*:*:*:*:*
cpe:2.3:a:gnome:gnome_online_accounts:3.6.1:*:*:*:*:*:*:*
cpe:2.3:a:gnome:gnome_online_accounts:3.6.2:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:gnome:gnome_online_accounts:3.7.1:*:*:*:*:*:*:*
cpe:2.3:a:gnome:gnome_online_accounts:3.7.2:*:*:*:*:*:*:*
cpe:2.3:a:gnome:gnome_online_accounts:3.7.3:*:*:*:*:*:*:*
cpe:2.3:a:gnome:gnome_online_accounts:3.7.4:*:*:*:*:*:*:*
cpe:2.3:a:gnome:gnome_online_accounts:3.7.90:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
History

07 Nov 2023, 02:14

Type Values Removed Values Added
Summary Gnome Online Accounts (GOA) 3.6.x before 3.6.3 and 3.7.x before 3.7.91, does not properly validate SSL certificates when creating accounts for providers who use the libsoup library, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network. NOTE: this issue exists because of an incomplete fix for CVE-2013-0240. Gnome Online Accounts (GOA) 3.6.x before 3.6.3 and 3.7.x before 3.7.91, does not properly validate SSL certificates when creating accounts for providers who use the libsoup library, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network. NOTE: this issue exists because of an incomplete fix for CVE-2013-0240.

13 Feb 2023, 04:41

Type Values Removed Values Added
Summary Gnome Online Accounts (GOA) 3.6.x before 3.6.3 and 3.7.x before 3.7.91, does not properly validate SSL certificates when creating accounts for providers who use the libsoup library, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network. NOTE: this issue exists because of an incomplete fix for CVE-2013-0240. Gnome Online Accounts (GOA) 3.6.x before 3.6.3 and 3.7.x before 3.7.91, does not properly validate SSL certificates when creating accounts for providers who use the libsoup library, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network. NOTE: this issue exists because of an incomplete fix for CVE-2013-0240.
Information

Published : 2013-04-02 03:23

Updated : 2023-12-10 11:16

NVD link : CVE-2013-1799

Mitre link : CVE-2013-1799

CVE.ORG link : CVE-2013-1799

JSON object : View

Products Affected

gnome

  • gnome_online_accounts

canonical

  • ubuntu_linux
CWE
CWE-310

Cryptographic Issues