Bug 1186594 - (CVE-2016-20011) VUL-0: CVE-2016-20011: libgrss: Does not perform TLS certificate validation
(CVE-2016-20011)
VUL-0: CVE-2016-20011: libgrss: Does not perform TLS certificate validation
Status: RESOLVED WONTFIX
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Cliff Zhao
Security Team bot
https://smash.suse.de/issue/300755/
CVSSv3.1:SUSE:CVE-2016-20011:6.8:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2021-05-28 12:12 UTC by Gianluca Gabrielli
Modified: 2022-08-23 08:05 UTC (History)
7 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Gianluca Gabrielli 2021-05-28 12:12:12 UTC
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.

References:

https://bugzilla.gnome.org/show_bug.cgi?id=772647
https://gitlab.gnome.org/GNOME/libgrss/-/issues/4

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1965453
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-20011
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-20011
https://bugzilla.gnome.org/show_bug.cgi?id=772647
https://gitlab.gnome.org/GNOME/libgrss/-/issues/4
Comment 1 Gianluca Gabrielli 2021-05-28 12:15:12 UTC
Affected packages:
 - SUSE:SLE-15:Update/libgrss      0.7.0
 - openSUSE:Factory/libgrss        0.7.0

No patch has been released yet.

The following are the affected lines:

openSUSE:Factory/libgrss-0.7.0/src/feed-channel.c:1113: session = soup_session_async_new ();
openSUSE:Factory/libgrss-0.7.0/src/feed-channel.c:1230: session = soup_session_async_new ();
openSUSE:Factory/libgrss-0.7.0/src/feeds-subscriber.c:517:              sub->priv->soupsession = soup_session_async_new ();
openSUSE:Factory/libgrss-0.7.0/src/feed-enclosure.c:285:        session = soup_session_async_new ();
openSUSE:Factory/libgrss-0.7.0/src/feeds-publisher.c:884:               pub->priv->soupsession = soup_session_async_new ();
openSUSE:Factory/libgrss-0.7.0/src/feeds-pool.c:180:    node->priv->soupsession = soup_session_async_new ();
openSUSE:Factory/libgrss-0.7.0/src/feed-channel.c:1013: session = soup_session_sync_new ();
openSUSE:Factory/libgrss-0.7.0/src/feed-channel.c:1143: session = soup_session_sync_new ();
openSUSE:Factory/libgrss-0.7.0/src/feed-enclosure.c:222:        session = soup_session_sync_new ();

SUSE:SLE-15:Update/libgrss-0.7.0/src/feed-channel.c:1113:       session = soup_session_async_new ();
SUSE:SLE-15:Update/libgrss-0.7.0/src/feed-channel.c:1230:       session = soup_session_async_new ();
SUSE:SLE-15:Update/libgrss-0.7.0/src/feeds-subscriber.c:517:            sub->priv->soupsession = soup_session_async_new ();
SUSE:SLE-15:Update/libgrss-0.7.0/src/feed-enclosure.c:285:      session = soup_session_async_new ();
SUSE:SLE-15:Update/libgrss-0.7.0/src/feeds-publisher.c:884:             pub->priv->soupsession = soup_session_async_new ();
SUSE:SLE-15:Update/libgrss-0.7.0/src/feeds-pool.c:180:  node->priv->soupsession = soup_session_async_new ();
SUSE:SLE-15:Update/libgrss-0.7.0/src/feed-channel.c:1013:       session = soup_session_sync_new ();
SUSE:SLE-15:Update/libgrss-0.7.0/src/feed-channel.c:1143:       session = soup_session_sync_new ();
SUSE:SLE-15:Update/libgrss-0.7.0/src/feed-enclosure.c:222:      session = soup_session_sync_new ();
Comment 4 QK ZHU 2021-07-01 09:12:00 UTC
(In reply to Gianluca Gabrielli from comment #1)
> Affected packages:
>  - SUSE:SLE-15:Update/libgrss      0.7.0
>  - openSUSE:Factory/libgrss        0.7.0
> 
> No patch has been released yet.
> 

https://gitlab.gnome.org/GNOME/libgrss/-/merge_requests/7

I will submit the patch to our codebase once the MR is accepted.
Comment 5 Gabriele Sonnu 2022-05-04 13:09:02 UTC
SUSE:SLE-15-SP4:Update/libgrss is also affected.