In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:4004-1 advisory.

  - In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname     verification of the server's TLS certificate if the application fails to specify the expected server     identity. This is in contrast to its intended documented behavior, to fail the certificate verification.
    Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before     2.6.1, accept a TLS certificate if the certificate is valid for any host. (CVE-2020-13645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:3997-1 advisory.

  - In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname     verification of the server's TLS certificate if the application fails to specify the expected server     identity. This is in contrast to its intended documented behavior, to fail the certificate verification.
    Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before     2.6.1, accept a TLS certificate if the certificate is valid for any host. (CVE-2020-13645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:3944-1 advisory.

  - In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname     verification of the server's TLS certificate if the application fails to specify the expected server     identity. This is in contrast to its intended documented behavior, to fail the certificate verification.
    Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before     2.6.1, accept a TLS certificate if the certificate is valid for any host. (CVE-2020-13645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:3944-1 advisory.

  - In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname     verification of the server's TLS certificate if the application fails to specify the expected server     identity. This is in contrast to its intended documented behavior, to fail the certificate verification.
    Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before     2.6.1, accept a TLS certificate if the certificate is valid for any host. (CVE-2020-13645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the glib-networking package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In GNOME glib-networking through 2.64.2, the     implementation of GTlsClientConnection skips hostname     verification of the server's TLS certificate if the     application fails to specify the expected server     identity. This is in contrast to its intended     documented behavior, to fail the certificate     verification. Applications that fail to provide the     server identity, including Balsa before 2.5.11 and     2.6.x before 2.6.1, accept a TLS certificate if the     certificate is valid for any host.(CVE-2020-13645)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1094-1 advisory.

  - In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname     verification of the server's TLS certificate if the application fails to specify the expected server     identity. This is in contrast to its intended documented behavior, to fail the certificate verification.
    Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before     2.6.1, accept a TLS certificate if the certificate is valid for any host. (CVE-2020-13645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the glib-networking package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - In GNOME glib-networking through 2.64.2, the     implementation of GTlsClientConnection skips hostname     verification of the server's TLS certificate if the     application fails to specify the expected server     identity. This is in contrast to its intended     documented behavior, to fail the certificate     verification. Applications that fail to provide the     server identity, including Balsa before 2.5.11 and     2.6.x before 2.6.1, accept a TLS certificate if the     certificate is valid for any host.(CVE-2020-13645)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the glib-networking package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - In GNOME glib-networking through 2.64.2, the     implementation of GTlsClientConnection skips hostname     verification of the server's TLS certificate if the     application fails to specify the expected server     identity. This is in contrast to its intended     documented behavior, to fail the certificate     verification. Applications that fail to provide the     server identity, including Balsa before 2.5.11 and     2.6.x before 2.6.1, accept a TLS certificate if the     certificate is valid for any host.(CVE-2020-13645)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202007-50 (GLib Networking: Improper certificate validation)

    GTlsClientConnection skips hostname verification of the server&rsquo;s TLS       certificate if the application fails to specify the expected server       identity.
  Impact :

    There may be a breach of integrity or confidentiality in connections       made using GLib Networking.
  Workaround :

    There is no known workaround at this time.

It was discovered that glib-networking skipped hostname certificate verification if the application failed to specify the server identity.
A remote attacker could use this to perform a person-in-the-middle attack and expose sensitive information.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the glib package has been released.

Security fix for CVE-2020-13645

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix CVE-2020-13645, fail connections when server identity is unset

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
156051	SUSE SLES12 Security Update : glib-networking (SUSE-SU-2021:4004-1)	Nessus	SuSE Local Security Checks	medium
156006	SUSE SLES15 Security Update : glib-networking (SUSE-SU-2021:3997-1)	Nessus	SuSE Local Security Checks	medium
155898	SUSE SLED15 / SLES15 Security Update : glib-networking (SUSE-SU-2021:3944-1)	Nessus	SuSE Local Security Checks	medium
155885	openSUSE 15 Security Update : glib-networking (openSUSE-SU-2021:3944-1)	Nessus	SuSE Local Security Checks	medium
152324	EulerOS 2.0 SP9 : glib-networking (EulerOS-SA-2021-2244)	Nessus	Huawei Local Security Checks	medium
152277	EulerOS 2.0 SP9 : glib-networking (EulerOS-SA-2021-2270)	Nessus	Huawei Local Security Checks	medium
152257	openSUSE 15 Security Update : balsa (openSUSE-SU-2021:1094-1)	Nessus	SuSE Local Security Checks	medium
147101	EulerOS Virtualization for ARM 64 3.0.6.0 : glib-networking (EulerOS-SA-2021-1583)	Nessus	Huawei Local Security Checks	medium
145733	EulerOS 2.0 SP8 : glib-networking (EulerOS-SA-2021-1143)	Nessus	Huawei Local Security Checks	medium
145162	EulerOS 2.0 SP3 : glib-networking (EulerOS-SA-2021-1070)	Nessus	Huawei Local Security Checks	medium
142514	EulerOS Virtualization 3.0.6.6 : glib-networking (EulerOS-SA-2020-2466)	Nessus	Huawei Local Security Checks	medium
142289	EulerOS 2.0 SP2 : glib-networking (EulerOS-SA-2020-2346)	Nessus	Huawei Local Security Checks	medium
142122	EulerOS 2.0 SP5 : glib-networking (EulerOS-SA-2020-2246)	Nessus	Huawei Local Security Checks	medium
140345	EulerOS Virtualization for ARM 64 3.0.2.0 : glib-networking (EulerOS-SA-2020-1975)	Nessus	Huawei Local Security Checks	medium
138973	GLSA-202007-50 : GLib Networking: Improper certificate validation	Nessus	Gentoo Local Security Checks	medium
137872	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : GLib Networking vulnerability (USN-4405-1)	Nessus	Ubuntu Local Security Checks	medium
137720	Photon OS 3.0: Glib PHSA-2020-3.0-0103	Nessus	PhotonOS Local Security Checks	medium
137687	Fedora 31 : mingw-glib-networking (2020-cadbc5992f)	Nessus	Fedora Local Security Checks	medium
137684	Fedora 32 : mingw-glib-networking (2020-a83c8cd358)	Nessus	Fedora Local Security Checks	medium
137575	Fedora 31 : glib-networking (2020-98ebbd1397)	Nessus	Fedora Local Security Checks	medium
137302	Photon OS 2.0: Glib PHSA-2020-2.0-0252	Nessus	PhotonOS Local Security Checks	medium

Detections

Analytics

CVE-2020-13645

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium