Man-in-the-Middle (MitM) attack in libzapojit - CVE-2021-39360
Published: September 14, 2022
Vulnerability identifier: #VU67361
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-39360
CWE-ID: CWE-300
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to zpj-skydrive.c does not enable TLS certificate verification on the SoupSessionSync objects it creates. A remote attacker can perform Man-in-the-Middle (MitM) attack.
Affected software
libzapojit
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Storage
SUSE Linux Enterprise Server
SUSE Linux Enterprise Workstation Extension
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
openSUSE Leap
openEuler
Fedora
SUSE Linux Enterprise Module for Packagehub Subpackages
libzapojit-0_0-0-debuginfo
libzapojit-debugsource
typelib-1_0-Zpj-0_0
libzapojit-devel
libzapojit-0_0-0
libzapojit-debuginfo
libzapojit
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Storage
SUSE Linux Enterprise Server
SUSE Linux Enterprise Workstation Extension
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
openSUSE Leap
openEuler
Fedora
SUSE Linux Enterprise Module for Packagehub Subpackages
libzapojit-0_0-0-debuginfo
libzapojit-debugsource
typelib-1_0-Zpj-0_0
libzapojit-devel
libzapojit-0_0-0
libzapojit-debuginfo
libzapojit
How to mitigate CVE-2021-39360
Install updates from vendor's website.
libzapojit-0_0-0-debuginfo - addressed in versions 0.0.3-5.3.1, 0.0.3-150000.3.5.1
libzapojit-debugsource - addressed in versions 0.0.3-5.3.1, 0.0.3-150000.3.5.1
typelib-1_0-Zpj-0_0 - addressed in versions 0.0.3-5.3.1, 0.0.3-150000.3.5.1
libzapojit-devel - addressed in versions 0.0.3-5.3.1, 0.0.3-150000.3.5.1
libzapojit-0_0-0 - addressed in versions 0.0.3-5.3.1, 0.0.3-150000.3.5.1
libzapojit-devel - update to 0.0.3-16
libzapojit-debugsource - update to 0.0.3-16
libzapojit-debuginfo - update to 0.0.3-16
libzapojit - update to 0.0.3-16
libzapojit - addressed in versions 0.0.3-19.fc33, 0.0.3-20.fc34, 0.0.3-21.fc35
libzapojit-debugsource - addressed in versions 0.0.3-5.3.1, 0.0.3-150000.3.5.1
typelib-1_0-Zpj-0_0 - addressed in versions 0.0.3-5.3.1, 0.0.3-150000.3.5.1
libzapojit-devel - addressed in versions 0.0.3-5.3.1, 0.0.3-150000.3.5.1
libzapojit-0_0-0 - addressed in versions 0.0.3-5.3.1, 0.0.3-150000.3.5.1
libzapojit-devel - update to 0.0.3-16
libzapojit-debugsource - update to 0.0.3-16
libzapojit-debuginfo - update to 0.0.3-16
libzapojit - update to 0.0.3-16
libzapojit - addressed in versions 0.0.3-19.fc33, 0.0.3-20.fc34, 0.0.3-21.fc35
External References
- https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification/
- https://gitlab.gnome.org/GNOME/libzapojit/-/issues/4
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNSIMQXP6VQWJXI7VW7ZCLCS4NWW465T/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IDXCHOCVP3VSAKDBQSLER2DQHFIOUHAT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UG7TUICJM4QJHI4QJ2RHOSQE2QWD3KO3/