Security update for gfbgraph SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2876-1 Final 1 1 2022-08-23T11:31:05Z current 2022-08-23T11:31:05Z 2022-08-23T11:31:05Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for gfbgraph This update for gfbgraph fixes the following issues: - CVE-2021-39358: Fixed missing TLS certificate verification (bsc#1189850). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-2876,SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-2876,SUSE-SLE-Product-WE-15-SP3-2022-2876,openSUSE-SLE-15.3-2022-2876 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222876-1/ Link for SUSE-SU-2022:2876-1 https://lists.suse.com/pipermail/sle-security-updates/2022-August/011975.html E-Mail link for SUSE-SU-2022:2876-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1189850 SUSE Bug 1189850 https://www.suse.com/security/cve/CVE-2021-39358/ SUSE CVE CVE-2021-39358 page SUSE Linux Enterprise Module for Package Hub 15 SP3 SUSE Linux Enterprise Workstation Extension 15 SP3 openSUSE Leap 15.3 gfbgraph-devel-0.2.3-150000.3.5.1 libgfbgraph-0_2-0-0.2.3-150000.3.5.1 typelib-1_0-GFBGraph-0_2-0.2.3-150000.3.5.1 gfbgraph-devel-0.2.3-150000.3.5.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP3 libgfbgraph-0_2-0-0.2.3-150000.3.5.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP3 typelib-1_0-GFBGraph-0_2-0.2.3-150000.3.5.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP3 gfbgraph-devel-0.2.3-150000.3.5.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP3 libgfbgraph-0_2-0-0.2.3-150000.3.5.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP3 typelib-1_0-GFBGraph-0_2-0.2.3-150000.3.5.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP3 gfbgraph-devel-0.2.3-150000.3.5.1 as a component of openSUSE Leap 15.3 libgfbgraph-0_2-0-0.2.3-150000.3.5.1 as a component of openSUSE Leap 15.3 typelib-1_0-GFBGraph-0_2-0.2.3-150000.3.5.1 as a component of openSUSE Leap 15.3 In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011. CVE-2021-39358 SUSE Linux Enterprise Module for Package Hub 15 SP3:gfbgraph-devel-0.2.3-150000.3.5.1 SUSE Linux Enterprise Module for Package Hub 15 SP3:libgfbgraph-0_2-0-0.2.3-150000.3.5.1 SUSE Linux Enterprise Module for Package Hub 15 SP3:typelib-1_0-GFBGraph-0_2-0.2.3-150000.3.5.1 SUSE Linux Enterprise Workstation Extension 15 SP3:gfbgraph-devel-0.2.3-150000.3.5.1 SUSE Linux Enterprise Workstation Extension 15 SP3:libgfbgraph-0_2-0-0.2.3-150000.3.5.1 SUSE Linux Enterprise Workstation Extension 15 SP3:typelib-1_0-GFBGraph-0_2-0.2.3-150000.3.5.1 openSUSE Leap 15.3:gfbgraph-devel-0.2.3-150000.3.5.1 openSUSE Leap 15.3:libgfbgraph-0_2-0-0.2.3-150000.3.5.1 openSUSE Leap 15.3:typelib-1_0-GFBGraph-0_2-0.2.3-150000.3.5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222876-1/ https://www.suse.com/security/cve/CVE-2021-39358.html CVE-2021-39358 https://bugzilla.suse.com/1189850 SUSE Bug 1189850