PT-2013-3398 · Gnome · Libsoup+1

Debarshi Ray · Published 2013-03-28 · Updated 2023-02-13 · CVE-2013-1799

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gnome Online Accounts (GOA) versions 3.6.x through 3.6.2 Gnome Online Accounts (GOA) versions 3.7.x through 3.7.90

Description The issue is related to the improper validation of SSL certificates when creating accounts for providers who use the libsoup library. This allows man-in-the-middle attackers to obtain sensitive information, such as credentials, by sniffing the network.

Recommendations For Gnome Online Accounts (GOA) versions 3.6.x through 3.6.2, update to version 3.6.3 or later. For Gnome Online Accounts (GOA) versions 3.7.x through 3.7.90, update to version 3.7.91 or later.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2013-1799

Affected Products

Gnome Online Accounts

Libsoup

References · 10

• http://secunia.com/advisories/52791 · Vendor Advisory
• http://secunia.com/advisories/51976 · Vendor Advisory
• http://ubuntu.com/usn/usn-1779-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-02/msg00046.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1799 · Security Note
• https://bugzilla.gnome.org/show_bug.cgi?id=693214 · Note
• https://git.gnome.org/browse/gnome-online-accounts/commit/?id=9cf4bc0ced2c53bcdd36922caa65afc8a167bbd8 · Note
• https://mail.gnome.org/archives/gnome-announce-list/2013-March/msg00007.html · Note
• https://mail.gnome.org/archives/gnome-announce-list/2013-March/msg00020.html · Note
• https://bugzilla.gnome.org/show_bug.cgi?id=695106 · Note