CVE-2016-20011 libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the....
HighCVSS 7.5
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libgrss(Debian:12) | All versions | No fix listed |
| debian/libgrss(Debian:12) | = 0.7.0-2 | No fix listed |
| debian/libgrss(Debian:12) | = 0.7.0-2.1 | No fix listed |
| debian/libgrss(Debian:12) | = 0.7.0-2.1~exp1 | No fix listed |
| GNOME libgrss | <= 0.7.0 | No fix listed |
| alpine/libgrss(Alpine:v3.13) | < 0.7.0-r1 | 0.7.0-r1 |
| alpine/libgrss(Alpine:v3.14) | < 0.7.0-r1 | 0.7.0-r1 |
| alpine/libgrss(Alpine:v3.15) | < 0.7.0-r1 | 0.7.0-r1 |
| alpine/libgrss(Alpine:v3.16) | < 0.7.0-r1 | 0.7.0-r1 |
| ubuntu/libgrss(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/libgrss(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2016-20011 vendor-advisory
- bugzilla.gnome.org issue-tracking vendor-advisory
- gitlab.gnome.org issue-tracking vendor-advisory
- gitlab.gnome.org mailing-list patch vendor-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking