ELA-246-1 glib-networking security update

insuficient certificate validation

2020-07-20
Packageglib-networking
Version2.42.0-2+deb8u1
Related CVEs CVE-2020-13645

GLib networking, the network extensions for GLib, failed to verify certificates’ hostnames if the application didn’t specify the server identity.

Applications must provide a server identity or GLib will fail with G_TLS_CERTIFICATE_BAD_IDENTITY.

For Debian 8 jessie, these problems have been fixed in version 2.42.0-2+deb8u1.

We recommend that you upgrade your glib-networking packages.

Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/