CVE-2016-20011

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-20011
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://bugzilla.gnome.org/show_bug.cgi?id=772647 Issue Tracking Vendor Advisory
https://gitlab.gnome.org/GNOME/libgrss/-/issues/4 Issue Tracking Vendor Advisory
https://gitlab.gnome.org/GNOME/libgrss/-/merge_requests/7.patch Mailing List Patch Vendor Advisory
https://bugzilla.gnome.org/show_bug.cgi?id=772647 Issue Tracking Vendor Advisory
https://gitlab.gnome.org/GNOME/libgrss/-/issues/4 Issue Tracking Vendor Advisory
https://gitlab.gnome.org/GNOME/libgrss/-/merge_requests/7.patch Mailing List Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:gnome:libgrss:*:*:*:*:*:*:*:*
History

21 Nov 2024, 02:47

Type Values Removed Values Added
References () https://bugzilla.gnome.org/show_bug.cgi?id=772647 - Issue Tracking, Vendor Advisory () https://bugzilla.gnome.org/show_bug.cgi?id=772647 - Issue Tracking, Vendor Advisory
References () https://gitlab.gnome.org/GNOME/libgrss/-/issues/4 - Issue Tracking, Vendor Advisory () https://gitlab.gnome.org/GNOME/libgrss/-/issues/4 - Issue Tracking, Vendor Advisory
References () https://gitlab.gnome.org/GNOME/libgrss/-/merge_requests/7.patch - Mailing List, Patch, Vendor Advisory () https://gitlab.gnome.org/GNOME/libgrss/-/merge_requests/7.patch - Mailing List, Patch, Vendor Advisory

09 Jun 2021, 15:03

Type Values Removed Values Added
References (MISC) https://gitlab.gnome.org/GNOME/libgrss/-/merge_requests/7.patch - (MISC) https://gitlab.gnome.org/GNOME/libgrss/-/merge_requests/7.patch - Mailing List, Patch, Vendor Advisory

08 Jun 2021, 14:15

Type Values Removed Values Added
References
  • (MISC) https://gitlab.gnome.org/GNOME/libgrss/-/merge_requests/7.patch -

01 Jun 2021, 17:03

Type Values Removed Values Added
CWE CWE-295
CPE cpe:2.3:a:gnome:libgrss:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : 5.0
v3 : 7.5
References (MISC) https://gitlab.gnome.org/GNOME/libgrss/-/issues/4 - (MISC) https://gitlab.gnome.org/GNOME/libgrss/-/issues/4 - Issue Tracking, Vendor Advisory
References (MISC) https://bugzilla.gnome.org/show_bug.cgi?id=772647 - (MISC) https://bugzilla.gnome.org/show_bug.cgi?id=772647 - Issue Tracking, Vendor Advisory

25 May 2021, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2021-05-25 21:15

Updated : 2024-11-21 02:47

NVD link : CVE-2016-20011

Mitre link : CVE-2016-20011

CVE.ORG link : CVE-2016-20011

JSON object : View

Products Affected

gnome

  • libgrss
CWE
CWE-295

Improper Certificate Validation