In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.
The product does not validate, or incorrectly validates, a certificate.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Grilo | Gnome | * | 0.3.13 (including) |
| Red Hat Enterprise Linux 8 | RedHat | grilo-0:0.3.6-3.el8 | * |
| Grilo | Ubuntu | bionic | * |
| Grilo | Ubuntu | devel | * |
| Grilo | Ubuntu | esm-infra/xenial | * |
| Grilo | Ubuntu | focal | * |
| Grilo | Ubuntu | hirsute | * |
| Grilo | Ubuntu | impish | * |
| Grilo | Ubuntu | jammy | * |
| Grilo | Ubuntu | trusty | * |
| Grilo | Ubuntu | xenial | * |