Bug 1189850 - (CVE-2021-39358) VUL-0: CVE-2021-39358: gfbgraph: missing TLS certificate verification
(CVE-2021-39358)
VUL-0: CVE-2021-39358: gfbgraph: missing TLS certificate verification
Status: NEW
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Major
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/307799/
CVSSv3.1:SUSE:CVE-2021-39358:7.5:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2021-08-26 14:56 UTC by Gianluca Gabrielli
Modified: 2022-10-19 03:39 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Gianluca Gabrielli 2021-08-26 14:56:36 UTC
Potential affected packages:
 - SUSE:SLE-15:Update/gfbgraph             0.2.3
 - openSUSE:Factory/gfbgraph               0.2.4
 - openSUSE:Backports:SLE-15-SP2/gfbgraph  0.2.3

No patch is available yet.
Comment 5 Swamp Workflow Management 2022-08-23 16:18:34 UTC
SUSE-SU-2022:2876-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1189850
CVE References: CVE-2021-39358
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    gfbgraph-0.2.3-150000.3.5.1
SUSE Linux Enterprise Workstation Extension 15-SP3 (src):    gfbgraph-0.2.3-150000.3.5.1
SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (src):    gfbgraph-0.2.3-150000.3.5.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 6 Jia Zhaocong 2022-10-19 03:39:17 UTC
Cleaning up GNOME CVE backlog. The fix has been submitted and accepted. Assign back to security team.