Published: 22/08/2021 Updated: 07/11/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 5.9 | Impact Score: 3.6 | Exploitability Score: 2.2

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

In GNOME libzapojit up to and including 0.0.3, zpj-skydrive.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnome libzapojit
fedoraproject fedora 33
fedoraproject fedora 34
fedoraproject fedora 35

Debian Bug report logs - #993538 libzapojit: CVE-2021-39360 Package: src:libzapojit; Maintainer for src:libzapojit is Debian GNOME Maintainers <pkg-gnome-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 2 Sep 2021 20:09:01 UTC Severity: important Tags: security, ...

In GNOME libzapojit through 003, zpj-skydrivec does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks NOTE: this is similar to CVE-2016-20011 (CVE-2021-39360) ...

In GNOME libzapojit through 003, zpj-skydrivec does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks NOTE: this is similar to CVE-2016-20011 ...

CWE-295 https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification/https://gitlab.gnome.org/GNOME/libzapojit/-/issues/4 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNSIMQXP6VQWJXI7VW7ZCLCS4NWW465T/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IDXCHOCVP3VSAKDBQSLER2DQHFIOUHAT/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UG7TUICJM4QJHI4QJ2RHOSQE2QWD3KO3/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993538 https://nvd.nist.gov https://alas.aws.amazon.com/AL2/ALAS-2023-2144.html

CVE-2021-39360

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect