CVE-2020-13645 describes a vulnerability in GNOME glib-networking (through version 2.64.2) where GTlsClientConnection fails to perform hostname verification on TLS certificates if the application does not explicitly provide the server identity, contrary to its intended design. This medium-severity vulnerability (CVSS 6.5) allows an attacker to present a valid certificate for any host, potentially leading to information disclosure or integrity compromise (CWE-295). While affecting products from Broadcom, Canonical, Fedora, GNOME, and NetApp, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.5.11CPE matchmatch criteria | cpe:2.3:a:gnome:balsa:*:*:*:*:*:*:*:* | ||
2.6.0CPE matchmatch criteria | cpe:2.3:a:gnome:balsa:2.6.0:*:*:*:*:*:*:* | ||
< 2.62.4CPE matchmatch criteria | cpe:2.3:a:gnome:glib-networking:*:*:*:*:*:*:*:* | ||
>= 2.64.0, < 2.64.3CPE matchmatch criteria | cpe:2.3:a:gnome:glib-networking:*:*:*:*:*:*:*:* | ||
16.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2020-13645
Aug 11, 2020In GNOME glib-networking through 2.64.2 the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior to fail the certificate verification. Applications that fail to provide the server identity including Balsa before 2.5.11 and 2.6.x before 2.6.1 accept a TLS certificate if the certificate is valid for any host.
May 12, 2020glib-networking: GTlsClientConnection silently ignores unset server identity
May 4, 2020