CVE-2020-13645
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips...
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.
- Record
CVE-2020-13645- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List No score
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.
- Record
CVE-2020-13645- Updated
- 2026-11-02
EUVDEUVD-2020-5887 No score
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.
- Record
EUVD-2020-5887- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p43h-5x4h-9pp7 No score
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips...
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.
- Record
GHSA-p43h-5x4h-9pp7- Weakness
- CWE-295
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-13645
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.
- Record
ALPINE-CVE-2020-13645- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
OSVAZL-6440
CVE-2020-13645 affecting package glib-networking for versions less than 2.59.1-8
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.
- Record
AZL-6440- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
Show 12 moreShow less
OSV
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.
- Record
CVE-2020-13645- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-13645
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.
- Record
DEBIAN-CVE-2020-13645- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-13645
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.
- Record
UBUNTU-CVE-2020-13645- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVMGASA-2020-0314 No score
Updated glib-networking packages fix security vulnerability
The updated packages fix a security vulnerability:
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host. (CVE-2020-13645)
- Record
MGASA-2020-0314- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1094-1 No score
Security update for balsa
This update for balsa fixes the following issues:
Update to version 2.6.1
- CVE-2020-13645: fix server identity verification (boo#1172460)
- Record
openSUSE-SU-2021:1094-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1554-1 No score
Security update for glib-networking
This update for glib-networking fixes the following issues:
Update to version 2.62.4:
- CVE-2020-13645: Fixed a connection failure when the server identity is unset (bsc#1172460).
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2021:1554-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:3944-1 No score
Security update for glib-networking
This update for glib-networking fixes the following issues:
Update to version 2.62.4:
- CVE-2020-13645: Fixed a connection failure when the server identity is unset (bsc#1172460).
- Record
openSUSE-SU-2021:3944-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10790-1 No score
glib-networking-2.68.1-1.3 on GA media
These are all security issues fixed in the glib-networking-2.68.1-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10790-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3944-1 No score
Security update for glib-networking
This update for glib-networking fixes the following issues:
Update to version 2.62.4:
- CVE-2020-13645: Fixed a connection failure when the server identity is unset (bsc#1172460).
- Record
SUSE-SU-2021:3944-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3997-1 No score
Security update for glib-networking
This update for glib-networking fixes the following issues:
- CVE-2020-13645: Fixed a connection failure when the server identity is unset (bsc#1172460).
- Record
SUSE-SU-2021:3997-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:4004-1 No score
Security update for glib-networking
This update for glib-networking fixes the following issues:
- CVE-2020-13645: Fixed a connection failure when the server identity is unset (bsc#1172460).
- Record
SUSE-SU-2021:4004-1- Updated
- 2026-11-02
OSVUSN-4405-1 No score
glib-networking vulnerability
It was discovered that glib-networking skipped hostname certificate verification if the application failed to specify the server identity. A remote attacker could use this to perform a person-in-the-middle attack and expose sensitive information.
- Record
USN-4405-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
glib-networkingAlpine:v3.12 |
2.64.0 up to 2.64.3-r0 | 2.64.3-r0 |
glib-networkingAlpine:v3.13 |
2.64.0 up to 2.64.3-r0 | 2.64.3-r0 |
glib-networkingAlpine:v3.14 |
2.64.0 up to 2.64.3-r0 | 2.64.3-r0 |
glib-networkingAlpine:v3.15 |
2.64.0 up to 2.64.3-r0 | 2.64.3-r0 |
glib-networkingAlpine:v3.16 |
2.64.0 up to 2.64.3-r0 | 2.64.3-r0 |
glib-networkingAlpine:v3.17 |
2.64.0 up to 2.64.3-r0 | 2.64.3-r0 |
glib-networkingAlpine:v3.18 |
2.64.0 up to 2.64.3-r0 | 2.64.3-r0 |
glib-networkingAlpine:v3.19 |
2.64.0 up to 2.64.3-r0 | 2.64.3-r0 |
glib-networkingAlpine:v3.20 |
2.64.0 up to 2.64.3-r0 | 2.64.3-r0 |
glib-networkingAlpine:v3.21 |
2.64.0 up to 2.64.3-r0 | 2.64.3-r0 |
Show 46 moreShow less
| Package | Affected | Fixed |
|---|---|---|
glib-networkingAlpine:v3.22 |
2.64.0 up to 2.64.3-r0 | 2.64.3-r0 |
glib-networkingAlpine:v3.23 |
2.64.0 up to 2.64.3-r0 | 2.64.3-r0 |
glib-networkingAlpine:v3.24 |
2.64.0 up to 2.64.3-r0 | 2.64.3-r0 |
glib-networkingAzure Linux:2 |
before 2.59.1-8 | 2.59.1-8 |
glib-networkingDebian:12 |
before 2.64.3-2 | 2.64.3-2 |
glib-networkingDebian:13 |
before 2.64.3-2 | 2.64.3-2 |
glib-networkingDebian:14 |
before 2.64.3-2 | 2.64.3-2 |
glib-networkingMageia:7 |
before 2.60.2-1.1.mga7 | 2.60.2-1.1.mga7 |
glib-networkingSUSE:Linux Enterprise Module for Basesystem 15 SP2 |
before 2.62.4-3.3.1 | 2.62.4-3.3.1 |
glib-networkingSUSE:Linux Enterprise Module for Basesystem 15 SP3 |
before 2.62.4-3.3.1 | 2.62.4-3.3.1 |
glib-networkingSUSE:Linux Enterprise Micro 5.0 |
before 2.62.4-3.3.1 | 2.62.4-3.3.1 |
glib-networkingSUSE:Linux Enterprise Micro 5.1 |
before 2.62.4-3.3.1 | 2.62.4-3.3.1 |
glib-networkingSUSE:Linux Enterprise High Performance Computing 15-ESPOS |
before 2.54.1-3.6.1 | 2.54.1-3.6.1 |
glib-networkingSUSE:Linux Enterprise High Performance Computing 15-LTSS |
before 2.54.1-3.6.1 | 2.54.1-3.6.1 |
glib-networkingSUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS |
before 2.54.1-3.6.1 | 2.54.1-3.6.1 |
glib-networkingSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS |
before 2.54.1-3.6.1 | 2.54.1-3.6.1 |
glib-networkingSUSE:Linux Enterprise Server 15-LTSS |
before 2.54.1-3.6.1 | 2.54.1-3.6.1 |
glib-networkingSUSE:Linux Enterprise Server 15 SP1-BCL |
before 2.54.1-3.6.1 | 2.54.1-3.6.1 |
glib-networkingSUSE:Linux Enterprise Server 15 SP1-LTSS |
before 2.54.1-3.6.1 | 2.54.1-3.6.1 |
glib-networkingSUSE:Linux Enterprise Server for SAP Applications 15 |
before 2.54.1-3.6.1 | 2.54.1-3.6.1 |
glib-networkingSUSE:Linux Enterprise Server for SAP Applications 15 SP1 |
before 2.54.1-3.6.1 | 2.54.1-3.6.1 |
glib-networkingSUSE:Enterprise Storage 6 |
before 2.54.1-3.6.1 | 2.54.1-3.6.1 |
glib-networkingSUSE:HPE Helion OpenStack 8 |
before 2.48.2-6.3.1 | 2.48.2-6.3.1 |
glib-networkingSUSE:OpenStack Cloud 8 |
before 2.48.2-6.3.1 | 2.48.2-6.3.1 |
glib-networkingSUSE:OpenStack Cloud 9 |
before 2.48.2-6.3.1 | 2.48.2-6.3.1 |
glib-networkingSUSE:OpenStack Cloud Crowbar 8 |
before 2.48.2-6.3.1 | 2.48.2-6.3.1 |
glib-networkingSUSE:OpenStack Cloud Crowbar 9 |
before 2.48.2-6.3.1 | 2.48.2-6.3.1 |
glib-networkingSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 2.48.2-6.3.1 | 2.48.2-6.3.1 |
glib-networkingSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 2.48.2-6.3.1 | 2.48.2-6.3.1 |
glib-networkingSUSE:Linux Enterprise Server 12 SP2-BCL |
before 2.48.2-6.3.1 | 2.48.2-6.3.1 |
glib-networkingSUSE:Linux Enterprise Server 12 SP3-LTSS |
before 2.48.2-6.3.1 | 2.48.2-6.3.1 |
glib-networkingSUSE:Linux Enterprise Server 12 SP3-BCL |
before 2.48.2-6.3.1 | 2.48.2-6.3.1 |
glib-networkingSUSE:Linux Enterprise Server 12 SP4-LTSS |
before 2.48.2-6.3.1 | 2.48.2-6.3.1 |
glib-networkingSUSE:Linux Enterprise Server 12 SP5 |
before 2.48.2-6.3.1 | 2.48.2-6.3.1 |
glib-networkingSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 2.48.2-6.3.1 | 2.48.2-6.3.1 |
glib-networkingUbuntu:16.04:LTS |
before 2.48.2-1~ubuntu16.04.2, plus listed versions 2.46.0-12.46.1-12.46.1-1build12.48.0-12.48.2-1~ubuntu16.04.1 |
2.48.2-1~ubuntu16.04.2 |
glib-networkingUbuntu:18.04:LTS |
before 2.56.0-1ubuntu0.1, plus listed versions 2.54.0-12.54.1-12.54.1-22.55.90-12.56.0-1 |
2.56.0-1ubuntu0.1 |
balsaUbuntu:20.04:LTS |
before 2.6.0-2ubuntu0.1, plus listed versions 2.5.6-22.5.6-2build12.5.9-12.5.9-22.5.9-32.5.9-42.6.0-2 |
2.6.0-2ubuntu0.1 |
glib-networkingUbuntu:20.04:LTS |
before 2.64.2-1ubuntu0.1, plus listed versions 2.62.1-12.63.2-12.63.3-0build12.63.90-1ubuntu12.63.91-1ubuntu12.64.0-12.64.1-12.64.2-1build1 |
2.64.2-1ubuntu0.1 |
balsaSUSE:Package Hub 15 SP2 |
before 2.6.1-bp153.2.3.1 | 2.6.1-bp153.2.3.1 |
balsaSUSE:Package Hub 15 SP3 |
before 2.6.1-bp153.2.3.1 | 2.6.1-bp153.2.3.1 |
balsaopenSUSE:Leap 15.2 |
before 2.6.1-bp153.2.3.1 | 2.6.1-bp153.2.3.1 |
balsaopenSUSE:Leap 15.3 |
before 2.6.1-bp153.2.3.1 | 2.6.1-bp153.2.3.1 |
glib-networkingopenSUSE:Leap 15.2 |
before 2.62.4-lp152.2.3.1 | 2.62.4-lp152.2.3.1 |
glib-networkingopenSUSE:Leap 15.3 |
before 2.62.4-3.3.1 | 2.62.4-3.3.1 |
glib-networkingopenSUSE:Tumbleweed |
before 2.68.1-1.3 | 2.68.1-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-13645 is a medium vulnerability (CVSS 6.5) in Gnome Balsa, published May 28, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.02%, the 81st percentile. Fixed in glib-networking 2.64.3-r0.
References
gitlab.gnome.org/GNOME/glib-networking/-/issues/135
security.netapp.com/advisory/ntap-20200608-0004
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQEQJQ4XFMFCFJTEXKL2ZO3UELBPCKSK
Show 24 moreShow less
usn.ubuntu.com/4405-1
security.gentoo.org/glsa/202007-50
nvd.nist.gov/vuln/detail/CVE-2020-13645
github.com/advisories/GHSA-p43h-5x4h-9pp7
security.alpinelinux.org/vuln/CVE-2020-13645
security-tracker.debian.org/tracker/CVE-2020-13645
advisories.mageia.org/MGASA-2020-0314.html
bugs.mageia.org/show_bug.cgi?id=26819
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13645
ubuntu.com/security/notices/USN-4405-1
suse.com/support/update/announcement/2021/suse-su-20213944-1
bugzilla.suse.com/1172460
cve.org/CVERecord?id=CVE-2020-13645
lists.opensuse.org/archives/list/[email protected]/thread/42QNVR5Y3Z3YQLA2G7H66ZAGRYHVNWHT