{"id":"CVE-2021-39359","details":"In GNOME libgda through 6.0.0, gda-web-provider.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.","modified":"2026-07-08T06:02:10.927790652Z","published":"2021-08-22T19:15:07.157Z","related":["SUSE-SU-2022:3016-1","openSUSE-SU-2024:11803-1"],"database_specific":{"unresolved_ranges":[{"vendor_product":"fedoraproject:fedora","cpes":["cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"34"},{"last_affected":"34"},{"introduced":"35"},{"last_affected":"35"}],"source":"CPE_STRING"}]},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRPPP47WRCAPAEJGRMEKYYJZBQCYXTLQ/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLMVVIJNY5NMOT3FH36RFBWOTPVW7GME/"},{"type":"ADVISORY","url":"https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification/"},{"type":"REPORT","url":"https://gitlab.gnome.org/GNOME/libgda/-/issues/249"},{"type":"FIX","url":"https://github.com/GNOME/libgda/commit/bd7b9568bcd9f6d3e6680bb04323a670c842a62d"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gnome/libgda","events":[{"introduced":"0"},{"last_affected":"5d23892e1c8abd931ad2a7bd24cd543b93ccb04c"},{"fixed":"bd7b9568bcd9f6d3e6680bb04323a670c842a62d"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:gnome:libgda:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"6.0.0"}]}}],"versions":["LIBGDA_6_0_0","LIBGDA_5_99_90","LIBGDA_5_90_1","LIBGDA_5_2_2","LIBGDA_5_2_1","LIBGDA_5_2_0","LIBGDA_5_1_2","LIBGDA_5_1_1","LIBGDA_5_1_0","LIBGDA_5_0_2","LIBGDA_5_0_1","LIBGDA_5_0_0","LIBGDA_4_99.4","LIBGDA_4_99_3","LIBGDA_4_99_2","LIBGDA_4_99.1","LIBGDA_4_2_5","LIBGDA_4_2_4","LIBGDA_4_2_3","LIBGDA_4_2_2","LIBGDA_4_2_1","LIBGDA_4_2_0","LIBGDA_4_1_11","LIBGDA_4_1_10","LIBGDA_4_1_9","LIBGDA_4_1_8","LIBGDA_4_1_7","LIBGDA_4_1_6","LIBGDA_4_1_5","LIBGDA_4_1_4","LIBGDA_4_1_3","LIBGDA_4_1_2","LIBGDA_4_1_1","LIBGDA_4_1_0","LIBGDA_4.0.0","LIBGDA_3_99_14","LIBGDA_3_99_13","LIBGDA_3_99_12","LIBGDA_3_99_11","LIBGDA_3_99_10","LIBGDA_3_99_9","LIBGDA_3_99_8","LIBGDA_3_99_7","LIBGDA_3_99_6","LIBGDA_3_99_5","LIBGDA_3_99_4","LIBGDA_3_99_3","release-3-99-2","release-3.99.1","release-3.1.2","release-3-1-1","release-3-0-0","release-2-99-6","libgda_3_0_before_removing_gda_sharp","libgda_2_99_3","release-2-99-2","release-1-99-1","release-1-99-0","release-1-9-103","release-1-9-102","release-1-9-100","release-1-9-99","release-1-3-91","release-1-3-90","release-1-3-4","release-1-3-3","release-1-3-2","release-1-3-1","release-1-3-0","release-1-2-0","release-1-1-99","release-1-1-6","release-1-1-5","release-1-1-4","release-1-1-3","release-1-1-2","release-1-1-1","release-1-1-0","release-0-91-0","release-0-90-0","release-0-12-1","release-0-12-0","release-0-11-0","release-0-10-0","release-0-8-199","release-0-8-193","release-0-8-192","release-0-8-191","release-0-8-190","release-0-8-105","release-0-8-104","release-0-8-103","release-0-8-102","release-0-8-101","release-0-8-100","release-0-8-99","release-0-2-9-branch","LIBGDA_0_1_0","GNOMEDB_0_1_0","REL_0_0_97"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-39359.json"}},{"ranges":[{"type":"GIT","repo":"https://gitlab.gnome.org/gnome/libgda","events":[{"introduced":"0"},{"last_affected":"5d23892e1c8abd931ad2a7bd24cd543b93ccb04c"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:gnome:libgda:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"6.0.0"}]}}],"versions":["LIBGDA_6_0_0","LIBGDA_5_99_90","LIBGDA_5_90_1","LIBGDA_5_2_2","LIBGDA_5_2_1","LIBGDA_5_2_0","LIBGDA_5_1_2","LIBGDA_5_1_1","LIBGDA_5_1_0","LIBGDA_5_0_2","LIBGDA_5_0_1","LIBGDA_5_0_0","LIBGDA_4_99.4","LIBGDA_4_99_3","LIBGDA_4_99_2","LIBGDA_4_99.1","LIBGDA_4_2_5","LIBGDA_4_2_4","LIBGDA_4_2_3","LIBGDA_4_2_2","LIBGDA_4_2_1","LIBGDA_4_2_0","LIBGDA_4_1_11","LIBGDA_4_1_10","LIBGDA_4_1_9","LIBGDA_4_1_8","LIBGDA_4_1_7","LIBGDA_4_1_6","LIBGDA_4_1_5","LIBGDA_4_1_4","LIBGDA_4_1_3","LIBGDA_4_1_2","LIBGDA_4_1_1","LIBGDA_4_1_0","LIBGDA_4.0.0","LIBGDA_3_99_14","LIBGDA_3_99_13","LIBGDA_3_99_12","LIBGDA_3_99_11","LIBGDA_3_99_10","LIBGDA_3_99_9","LIBGDA_3_99_8","LIBGDA_3_99_7","LIBGDA_3_99_6","LIBGDA_3_99_5","LIBGDA_3_99_4","LIBGDA_3_99_3","release-3-99-2","release-3.99.1","release-3.1.2","release-3-1-1","release-3-0-0","release-2-99-6","libgda_3_0_before_removing_gda_sharp","libgda_2_99_3","release-2-99-2","release-1-99-1","release-1-99-0","release-1-9-103","release-1-9-102","release-1-9-100","release-1-9-99","release-1-3-91","release-1-3-90","release-1-3-4","release-1-3-3","release-1-3-2","release-1-3-1","release-1-3-0","release-1-2-0","release-1-1-99","release-1-1-6","release-1-1-5","release-1-1-4","release-1-1-3","release-1-1-2","release-1-1-1","release-1-1-0","release-0-91-0","release-0-90-0","release-0-12-1","release-0-12-0","release-0-11-0","release-0-10-0","release-0-8-199","release-0-8-193","release-0-8-192","release-0-8-191","release-0-8-190","release-0-8-105","release-0-8-104","release-0-8-103","release-0-8-102","release-0-8-101","release-0-8-100","release-0-8-99","release-0-2-9-branch","LIBGDA_0_1_0","GNOMEDB_0_1_0","REL_0_0_97"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-39359.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}