CVE-2021-39361

Опубликовано: 22 авг. 2021

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

In GNOME evolution-rss through 0.3.96, network-soup.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.

Ссылки

https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification/
Vendor Advisory
https://gitlab.gnome.org/GNOME/evolution-rss/-/issues/11
Issue Tracking
Vendor Advisory
https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification/
Vendor Advisory
https://gitlab.gnome.org/GNOME/evolution-rss/-/issues/11
Issue Tracking
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:gnome:evolution-rss:*:*:*:*:*:*:*:*

Версия до 0.3.96 (включая)

EPSS

Процентиль: 29%

0.00107

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-295

Связанные уязвимости

CVE-2021-39361

CVSS3: 5.9

ubuntu

больше 4 лет назад

CVE-2021-39361

CVSS3: 5.9

debian

больше 4 лет назад

In GNOME evolution-rss through 0.3.96, network-soup.c does not enable ...

GHSA-hcvp-gmj3-5g5v

github

больше 3 лет назад

EPSS

Процентиль: 29%

0.00107

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-295