In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
History
07 Nov 2023, 03:16
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
22 Jun 2021, 14:47
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:* |
Information
Published : 2020-05-28 12:15
Updated : 2023-12-10 13:27
NVD link : CVE-2020-13645
Mitre link : CVE-2020-13645
CVE.ORG link : CVE-2020-13645
JSON object : View
Products Affected
netapp
- cloud_backup
gnome
- glib-networking
- balsa
broadcom
- fabric_operating_system
canonical
- ubuntu_linux
fedoraproject
- fedora
CWE
CWE-295
Improper Certificate Validation