Improper Certificate Validation in libgda - CVE-2021-39359

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU66986

Improper Certificate Validation in libgda - CVE-2021-39359

Published: September 5, 2022


Vulnerability identifier: #VU66986
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-39359
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to missing certificate validation in gda-web-provider.c, which does not enable TLS certificate verification on the SoupSessionSync objects it creates. A remote attacker can perform Man-in-the-Middle (MitM) attack.


Affected software

libgda
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Workstation Extension
Fedora
libgda-5_0-4-debuginfo
typelib-1_0-Gdaui-5_0
typelib-1_0-Gda-5_0
libgda-5_0-devel-debuginfo
libgda-5_0-devel
libgda-5_0-4-lang
libgda-ui-5_0-4-debuginfo
libgda-ui-5_0-4
libgda-debugsource
libgda-5_0-sqlite-debuginfo
libgda-5_0-sqlite
libgda-5_0-postgres-debuginfo
libgda-5_0-postgres
libgda-5_0-mysql-debuginfo
libgda-5_0-mysql
libgda-5_0-4
libgda

How to mitigate CVE-2021-39359

Install updates from vendor's website.

libgda-5_0-4-debuginfo - update to 5.2.4-9.3.1
typelib-1_0-Gdaui-5_0 - update to 5.2.4-9.3.1
typelib-1_0-Gda-5_0 - update to 5.2.4-9.3.1
libgda-5_0-devel-debuginfo - update to 5.2.4-9.3.1
libgda-5_0-devel - update to 5.2.4-9.3.1
libgda-5_0-4-lang - update to 5.2.4-9.3.1
libgda-ui-5_0-4-debuginfo - update to 5.2.4-9.3.1
libgda-ui-5_0-4 - update to 5.2.4-9.3.1
libgda-debugsource - update to 5.2.4-9.3.1
libgda-5_0-sqlite-debuginfo - update to 5.2.4-9.3.1
libgda-5_0-sqlite - update to 5.2.4-9.3.1
libgda-5_0-postgres-debuginfo - update to 5.2.4-9.3.1
libgda-5_0-postgres - update to 5.2.4-9.3.1
libgda-5_0-mysql-debuginfo - update to 5.2.4-9.3.1
libgda-5_0-mysql - update to 5.2.4-9.3.1
libgda-5_0-4 - update to 5.2.4-9.3.1
libgda - addressed in versions 5.2.10-4.fc34, 5.2.10-4.fc35

External References

Related Security Bulletins