Vulnerability CVE-2021-39365

Vulnerability Name:

CVE-2021-39365 (CCN-208005)

Assigned:

2021-05-25

Published:

2021-05-25

Updated:

2021-12-16

Summary:

In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks.
Note: this is similar to CVE-2016-20011.

CVSS v3 Severity:

5.9 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
5.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

9.1 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
8.0 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): None

7.5 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
6.6 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

9.4 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): None

Vulnerability Type:

CWE-295

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2021-39365

Source: MISC
Type: Vendor Advisory
https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification/

Source: XF
Type: UNKNOWN
gnome-cve202139365-mitm(208005)

Source: CCN
Type: grilo GIT Repository
(CVE-2021-39365) Missing TLS certificate verification

Source: MISC
Type: Issue Tracking, Patch, Vendor Advisory
https://gitlab.gnome.org/GNOME/grilo/-/issues/146

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20210921 [SECURITY] [DLA 2762-1] grilo security update

Source: DEBIAN
Type: Third Party Advisory
DSA-4964

Vulnerable Configuration:

Configuration 1:

cpe:/a:gnome:grilo:*:*:*:*:*:*:*:* (Version <= 0.3.13)

Configuration 2:

cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*

OR cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*

OR cpe:/o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Configuration RedHat 1:

cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

Configuration RedHat 3:

cpe:/a:redhat:enterprise_linux:8::crb:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:7898	P	grilo-devel-0.3.14-150400.1.11 on GA media (Moderate)	2023-06-12
oval:org.opensuse.security:def:3563	P	libXpm4-3.5.11-5.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3280	P	libvorbis-doc-1.3.3-10.14.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:94910	P	grilo-devel-0.3.14-150400.1.11 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:94800	P	python3-ecdsa-0.13.3-3.7.1 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:95193	P	grilo-lang-0.3.14-150400.1.11 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:99743	P	(Important)	2022-02-04
oval:org.opensuse.security:def:112360	P	grilo-devel-0.3.13-2.2 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:105872	P	Security update for xen (Moderate)	2021-12-09
oval:com.redhat.rhsa:def:20214339	P	RHSA-2021:4339: grilo security update (Moderate)	2021-11-09
oval:org.opensuse.security:def:99150	P	(Moderate)	2021-10-20
oval:org.opensuse.security:def:9039	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:99345	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:92594	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:106035	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:70298	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:10158	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:92005	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:69544	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:9404	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:99544	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:92793	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:106234	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:70485	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:10345	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:8657	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:98955	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:92200	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:105645	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:69735	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:9595	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:106433	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:8844	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:92395	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:105840	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:69934	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:9794	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:100054	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:106719	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:101513	P	Security update for postgresql13 (Moderate)	2021-09-29
oval:org.opensuse.security:def:111071	P	Security update for grilo (Important)	2021-09-28
oval:org.opensuse.security:def:4220	P	Security update for grilo (Important)	2021-09-23
oval:org.opensuse.security:def:108179	P	Security update for grilo (Important)	2021-09-23
oval:org.opensuse.security:def:117693	P	Security update for grilo (Important)	2021-09-23
oval:org.opensuse.security:def:74312	P	Security update for grilo (Important)	2021-09-23
oval:org.opensuse.security:def:1033	P	Security update for grilo (Important)	2021-09-23
oval:org.opensuse.security:def:102992	P	Security update for grilo (Important)	2021-09-23
oval:org.opensuse.security:def:109658	P	Security update for grilo (Important)	2021-09-23
oval:org.opensuse.security:def:119798	P	Security update for grilo (Important)	2021-09-23
oval:org.opensuse.security:def:74377	P	Security update for grilo (Important)	2021-09-23
oval:org.opensuse.security:def:1780	P	Security update for grilo (Important)	2021-09-23
oval:org.opensuse.security:def:70798	P	Security update for grilo (Important)	2021-09-23
oval:org.opensuse.security:def:65244	P	Security update for grilo (Important)	2021-09-23
oval:org.opensuse.security:def:10658	P	Security update for grilo (Important)	2021-09-23
oval:org.opensuse.security:def:101724	P	Security update for grilo (Important)	2021-09-23
oval:org.opensuse.security:def:4155	P	Security update for grilo (Important)	2021-09-23
oval:org.opensuse.security:def:96320	P	Security update for grilo (Important)	2021-09-23
oval:org.opensuse.security:def:70835	P	Security update for grilo (Important)	2021-09-23
oval:org.opensuse.security:def:111723	P	Security update for grilo (Important)	2021-09-23
oval:org.opensuse.security:def:65309	P	Security update for grilo (Important)	2021-09-23
oval:org.opensuse.security:def:10695	P	Security update for grilo (Important)	2021-09-23
oval:org.opensuse.security:def:102332	P	Security update for grilo (Important)	2021-09-23
oval:org.opensuse.security:def:32999	P	Security update for grilo (Important)	2021-09-09
oval:org.opensuse.security:def:60357	P	Security update for grilo (Important)	2021-09-09
oval:org.opensuse.security:def:87463	P	Security update for grilo (Important)	2021-09-09
oval:org.opensuse.security:def:34534	P	Security update for grilo (Important)	2021-09-09
oval:org.opensuse.security:def:61089	P	Security update for grilo (Important)	2021-09-09
oval:org.opensuse.security:def:35266	P	Security update for grilo (Important)	2021-09-09
oval:org.opensuse.security:def:26125	P	Security update for grilo (Important)	2021-09-09
oval:org.opensuse.security:def:58822	P	Security update for grilo (Important)	2021-09-09
oval:org.opensuse.security:def:5112	P	Security update for grilo (Important)	2021-09-09

BACK