ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2020-13645

PoC ×2—
CVSS 3.1
6.5 medium
EPSS
2%p79
Published
()
Modified
Description

In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.

Vendors
gnomecanonicalfedoraprojectnetappbroadcom
Products
balsa, glib-networking, ubuntu linux, fedora, cloud backup, fabric operating system
Weakness
CWE-295
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD CVE.org GitHub PoCs EPSS (2.0%)

In the news

No ingested article mentions this CVE yet.