CVE-2020-13645

Vulnerability

In GNOME glib-networking through version 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate when the application fails to specify the expected server identity [1]. This contradicts the documented intended behavior, which requires that certificate verification should fail in such cases [1]. Applications that do not provide the server identity, including Balsa versions before 2.5.11 and 2.6.x before 2.6.1, accept any TLS certificate that is valid for any host [1].

Exploitation

An attacker in a privileged network position can perform a person-in-the-middle attack by presenting any valid TLS certificate to a vulnerable application. The attack requires no authentication or user interaction beyond the normal network traffic. If the application does not explicitly specify the expected server hostname, glib-networking will not verify the hostname match, allowing the attacker to intercept communications [1].

Impact

Successful exploitation leads to disclosure of sensitive information that the user exchanges with the intended server, as communications can be decrypted and monitored by the attacker [1]. The impact is limited to applications that rely on glib-networking and fail to set the server identity; the compromise scope is per-session data exposure.

Mitigation

Fixed versions are available: for Ubuntu, update glib-networking to the patched version provided in the Ubuntu security notice USN-4405-1 [1]. Users should also ensure any dependent application (such as Balsa) is updated to version 2.5.11 or 2.6.1 respectively [1]. No workaround other than applying the patch or updating the application to correctly specify the server identity has been published [1].