libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing     remote attackers to manipulate the contents of feeds without detection. This occurs because of the default     behavior of SoupSessionSync. (CVE-2016-20011)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing
    remote attackers to manipulate the contents of feeds without detection. This occurs because of the default
    behavior of SoupSessionSync. (CVE-2016-20011)

ID	Name	Product	Family	Type	Severity
219365	Linux Distros Unpatched Vulnerability : CVE-2016-20011	Nessus	Misc.	Local	high
405198	Alpine: libgrss: security update to 0.7.0-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
405198	Alpine: libgrss: security update to 0.7.0-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
400205	Alpine: libgrss: security update to 0.7.0-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
400205	Alpine: libgrss: security update to 0.7.0-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2016-20011

high

Tenable Plugins

high

high

high

high

high