Every CVE Search/ Get API key

CVE-2021-39358

In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification...

5.9 MediumFix available

In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.71%Up 0.1 points since Aug 23, 2021
90%50%10%1%

What each source reports

NVD Score used 5.9

In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.

Record
CVE-2021-39358
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-295
Updated
2026-11-02
CVE List No score

In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.

Record
CVE-2021-39358
Updated
2026-11-02
EUVDEUVD-2021-25719 No score

In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.

Record
EUVD-2021-25719
Updated
2026-11-03
GitHub AdvisoriesGHSA-hxcj-gvxh-8944 No score

In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification...

In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.

Record
GHSA-hxcj-gvxh-8944
Weakness
CWE-295
Updated
2026-11-02
OSV 5.9

In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.

Record
CVE-2021-39358
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2021-39358 5.9

In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.

Record
DEBIAN-CVE-2021-39358
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 9 moreShow less
OSVOESA-2021-1434 5.9

gfbgraph security update

GLib/GObject wrapper for the Facebook Graph API.

Security Fix(es):

In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.(CVE-2021-39358)

Record
OESA-2021-1434
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2022-1937 5.9

gfbgraph security update

GLib/GObject wrapper for the Facebook Graph API that integrates with GNOME Online Accounts.

Security Fix(es):

In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.(CVE-2021-39358)

Record
OESA-2022-1937
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2022:1801 7.5

Red Hat Security Advisory: gfbgraph security update

Record
RHSA-2022:1801
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2022:1801 7.5

Moderate: gfbgraph security update

GLib/GObject wrapper for the Facebook Graph API that integrates with GNOME Online Accounts.

The following packages have been upgraded to a later upstream version: gfbgraph (0.2.4). (BZ#1997941)

Security Fix(es):

  • gfbgraph: missing TLS certificate verification (CVE-2021-39358)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

Record
RLSA-2022:1801
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2021-39358 5.9

In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.

Record
UBUNTU-CVE-2021-39358
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVALSA-2022:1801 No score

Moderate: gfbgraph security update

GLib/GObject wrapper for the Facebook Graph API that integrates with GNOME Online Accounts.

The following packages have been upgraded to a later upstream version: gfbgraph (0.2.4). (BZ#1997941)

Security Fix(es):

  • gfbgraph: missing TLS certificate verification (CVE-2021-39358)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2022:1801
Updated
2026-11-02
OSVMGASA-2021-0530 No score

Updated gfbgraph packages fix security vulnerability

In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.

Record
MGASA-2021-0530
Updated
2026-11-02
OSVopenSUSE-SU-2024:11608-1 No score

gfbgraph-devel-0.2.5-1.1 on GA media

These are all security issues fixed in the gfbgraph-devel-0.2.5-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11608-1
Updated
2026-11-02
OSVSUSE-SU-2022:2876-1 No score

Security update for gfbgraph

This update for gfbgraph fixes the following issues:

  • CVE-2021-39358: Fixed missing TLS certificate verification (bsc#1189850).
Record
SUSE-SU-2022:2876-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gfbgraph
AlmaLinux:8
 before 0.2.4-1.el8
0.2.4-1.el8
gfbgraph
Debian:11
 All versions, plus listed versions
0.2.4-10.2.5-10.2.5-2
 None known
gfbgraph
Mageia:8
 before 0.2.4-1.1.mga8
0.2.4-1.1.mga8
gfbgraph
openEuler:20.03-LTS-SP1
 before 0.2.3-2.oe1
0.2.3-2.oe1
gfbgraph
openEuler:20.03-LTS-SP2
 before 0.2.3-2.oe1
0.2.3-2.oe1
gfbgraph
openEuler:20.03-LTS-SP3
 before 0.2.3-2.oe1
0.2.3-2.oe1
gfbgraph
Red Hat:enterprise_linux:8::appstream
 before 0:0.2.4-1.el8
0:0.2.4-1.el8
gfbgraph-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:0.2.4-1.el8
0:0.2.4-1.el8
gfbgraph-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:0.2.4-1.el8
0:0.2.4-1.el8
gfbgraph
Rocky Linux:8
 before 0:0.2.4-1.el8
0:0.2.4-1.el8
Show 7 moreShow less
Affected packages
PackageAffectedFixed
gfbgraph
SUSE:Linux Enterprise Module for Package Hub 15 SP3
 before 0.2.3-150000.3.5.1
0.2.3-150000.3.5.1
gfbgraph
SUSE:Linux Enterprise Workstation Extension 15 SP3
 before 0.2.3-150000.3.5.1
0.2.3-150000.3.5.1
gfbgraph
openSUSE:Leap 15.3
 before 0.2.3-150000.3.5.1
0.2.3-150000.3.5.1
gfbgraph
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.2.3-1
 None known
gfbgraph
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.2.3-10.2.3-2
 None known
gfbgraph
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.2.3-3
 None known
gfbgraph
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.2.4-10.2.5-2
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-39358 is a medium vulnerability (CVSS 5.9) in Gnome Libgfbgraph, published August 22, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.71%, the 53rd percentile. Fixed in gfbgraph 0.2.4-1.el8.

References

Show 24 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open