PublicDateAtUSN: 2020-05-28 12:15:00 UTC
Candidate: CVE-2020-13645
PublicDate: 2020-05-28 12:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13645
 https://ubuntu.com/security/notices/USN-4405-1
Description:
 In GNOME glib-networking through 2.64.2, the implementation of
 GTlsClientConnection skips hostname verification of the server's TLS
 certificate if the application fails to specify the expected server
 identity. This is in contrast to its intended documented behavior, to fail
 the certificate verification. Applications that fail to provide the server
 identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a
 TLS certificate if the certificate is valid for any host.
Ubuntu-Description:
Notes:
 mdeslaur> fixing this issue in glib-networking will require fixing
 mdeslaur> balsa too
Mitigation:
Bugs:
 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=961756
 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=961792
 https://gitlab.gnome.org/GNOME/glib-networking/-/issues/135
 https://gitlab.gnome.org/GNOME/balsa/-/issues/34
Priority: medium
Discovered-by:
Assigned-to: amurray
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N [6.5 MEDIUM]


Patches_glib-networking:
 upstream: https://gitlab.gnome.org/GNOME/glib-networking/-/commit/29513946809590c4912550f6f8620468f9836d94
upstream_glib-networking: needs-triage
precise/esm_glib-networking: DNE
trusty_glib-networking: ignored (out of standard support)
trusty/esm_glib-networking: DNE
xenial_glib-networking: released (2.48.2-1~ubuntu16.04.2)
esm-infra/xenial_glib-networking: released (2.48.2-1~ubuntu16.04.2)
bionic_glib-networking: released (2.56.0-1ubuntu0.1)
eoan_glib-networking: released (2.62.1-1ubuntu0.1)
focal_glib-networking: released (2.64.2-1ubuntu0.1)
devel_glib-networking: released (2.64.2-1ubuntu1)

Patches_balsa:
 upstream: https://gitlab.gnome.org/GNOME/balsa/-/commit/e8952e3ccb1bb5094a6f8920e7c274e2e7dae184
upstream_balsa: needs-triage
precise/esm_balsa: DNE
trusty_balsa: ignored (out of standard support)
trusty/esm_balsa: DNE
xenial_balsa: not-affected (code not present)
bionic_balsa: not-affected (code not present)
eoan_balsa: released (2.5.6-2ubuntu0.1)
focal_balsa: released (2.6.0-2ubuntu0.1)
devel_balsa: not-affected (2.6.1-1)