Bug 809722 – <net-libs/libgfbgraph-0.2.5: improper TLS verification (CVE-2021-39358)

• Status: IN_PROGRESS
• Product: Gentoo Security

[Description Sam James 2021-08-23 00:27:12 UTC]

CVE-2021-39358 (https://gitlab.gnome.org/GNOME/libgfbgraph/-/issues/17):

In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.

[Comment 1 Larry the Git Cow 2021-11-11 12:59:21 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7b5ce63ca04c9e2be5fed284f067670672adf9b6

commit 7b5ce63ca04c9e2be5fed284f067670672adf9b6
Author:     Pacho Ramos <[e-mail]>
AuthorDate: 2021-11-11 12:06:50 +0000
Commit:     Pacho Ramos <[e-mail]>
CommitDate: 2021-11-11 12:59:07 +0000

    net-libs/libgfbgraph: Bump to 0.2.5
    
    Bug: https://bugs.gentoo.org/809722
    Package-Manager: Portage-3.0.28, Repoman-3.0.3
    Signed-off-by: Pacho Ramos <[e-mail]>

 net-libs/libgfbgraph/Manifest                 |  1 +
 net-libs/libgfbgraph/libgfbgraph-0.2.5.ebuild | 53 +++++++++++++++++++++++++++
 2 files changed, 54 insertions(+)

[Comment 2 John Helmert III 2021-11-11 15:27:56 UTC]

Please file a stablereq when ready

[Comment 3 John Helmert III 2021-12-17 19:42:28 UTC]

Please cleanup

[Comment 4 Matt Turner 2022-04-20 02:38:38 UTC]

Clean.

[Comment 5 John Helmert III 2022-04-20 15:23:11 UTC]

Thanks!

[Comment 6 Larry the Git Cow 2023-04-30 10:07:51 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=707f9fb081e563f01250f5b0848924fda790c87a

commit 707f9fb081e563f01250f5b0848924fda790c87a
Author:     David Seifert <[e-mail]>
AuthorDate: 2023-04-30 10:06:23 +0000
Commit:     David Seifert <[e-mail]>
CommitDate: 2023-04-30 10:06:23 +0000

    net-libs/libgfbgraph: treeclean
    
    Bug: https://bugs.gentoo.org/809722
    Signed-off-by: David Seifert <[e-mail]>

 net-libs/libgfbgraph/Manifest                 |  1 -
 net-libs/libgfbgraph/libgfbgraph-0.2.5.ebuild | 53 ---------------------------
 net-libs/libgfbgraph/metadata.xml             | 11 ------
 profiles/package.mask                         |  7 ----
 4 files changed, 72 deletions(-)