PT-2012-3827 · Gnome+2 · Libsoup+2

Michael Vogt · Published 2012-07-12 · Updated 2017-08-29 · CVE-2012-2132

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions libsoup versions 2.32.2 and earlier

Description The issue allows remote attackers to bypass authentication by connecting with an SSL connection, as it does not validate certificates or clear the trust flag when the ssl-ca-file does not exist.

Recommendations For versions 2.32.2 and earlier, ensure the ssl-ca-file exists and is properly configured to validate certificates and maintain the trust flag. As a temporary workaround, consider disabling SSL connections until a proper fix is applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2012-2132

SUSE-SU-2012_0870-1

Affected Products

Debian

Suse

Libsoup

References · 19

• https://osv.dev/vulnerability/CVE-2012-2132 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2132 · Security Note
• https://security-tracker.debian.org/tracker/source-package/midori · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-2132 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-2132 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2132 · Security Note
• https://lists.suse.com/pipermail/sle-security-updates/2012-July/000178.html · Note
• http://openwall.com/lists/oss-security/2012/05/02/8 · Note
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Note
• http://openwall.com/lists/oss-security/2012/04/24/3 · Note
• http://openwall.com/lists/oss-security/2012/04/24/13 · Note
• https://packages.debian.org/src:midori · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75167 · Note
• http://download.novell.com/patch/finder/?keywords=625e36b09557835cd71a8041f2d28e18 · Note
• https://bugzilla.novell.com/758431 · Note