Ubuntu
gnome-online-accounts package

  1. Bug #1117411
  2. Comment #9

Comment 9 for bug 1117411

Revision history for this message
In , Vincent (vincent-redhat-bugs) wrote :

Just to note that CVE-2013-1799 was assigned to the incomplete fix present in 3.6.3 and 3.7.5 (I'm presuming some beta or pre-releases).

Common Vulnerabilities and Exposures assigned an identifier CVE-2013-0240 to
the following vulnerability:

Name: CVE-2013-0240
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0240
Assigned: 20121206
Reference: https://mail.gnome.org/archives/gnome-announce-list/2013-March/msg00007.html
Reference: https://bugzilla.redhat.com/show_bug.cgi?id=894352
Reference: https://bugzilla.gnome.org/show_bug.cgi?id=693214
Reference: https://git.gnome.org/browse/gnome-online-accounts/commit/?h=gnome-3-6&id=ecad8142e9ac519b9fc74b96dcb5531052bbffe1
Reference: https://git.gnome.org/browse/gnome-online-accounts/commit/?id=bc10fdb68f75f8be84eb698ada08743b9c7c248f
Reference: https://git.gnome.org/browse/gnome-online-accounts/commit/?id=edde7c63326242a60a075341d3fea0be0bc4d80e

Gnome Online Accounts (GOA) 3.4.x, 3.6.x before 3.6.3, and 3.7.x
before 3.7.5, does not properly validate SSL certificates when
creating accounts such as Windows Live and Facebook accounts, which
allows man-in-the-middle attackers to obtain sensitive information
such as credentials by sniffing the network.

Common Vulnerabilities and Exposures assigned an identifier CVE-2013-1799 to
the following vulnerability:

Name: CVE-2013-1799
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1799
Assigned: 20130219
Reference: https://mail.gnome.org/archives/gnome-announce-list/2013-March/msg00007.html
Reference: https://mail.gnome.org/archives/gnome-announce-list/2013-March/msg00020.html
Reference: https://bugzilla.gnome.org/show_bug.cgi?id=693214
Reference: https://bugzilla.gnome.org/show_bug.cgi?id=695106
Reference: https://git.gnome.org/browse/gnome-online-accounts/commit/?id=9cf4bc0ced2c53bcdd36922caa65afc8a167bbd8

Gnome Online Accounts (GOA) 3.6.x before 3.6.3 and 3.7.x before
3.7.91, does not properly validate SSL certificates when creating
accounts for providers who use the libsoup library, which allows
man-in-the-middle attackers to obtain sensitive information such as
credentials by sniffing the network. NOTE: this issue exists because
of an incomplete fix for CVE-2013-0240.

I do not believe that CVE-2013-1799 affects us as we have the fixed 3.6.3 and 3.4.2 updates. Can someone confirm that this is indeed the case?