CVE-2016-20011
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds,...
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.
- Record
CVE-2016-20011- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List No score
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.
- Record
CVE-2016-20011- Updated
- 2026-11-02
EUVDEUVD-2016-3099 No score
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.
- Record
EUVD-2016-3099- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x2mc-pw6q-5pv7 No score
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds,...
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.
- Record
GHSA-x2mc-pw6q-5pv7- Weakness
- CWE-295
- Updated
- 2026-11-02
OSVALPINE-CVE-2016-20011
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.
- Record
ALPINE-CVE-2016-20011- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
OSV
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.
- Record
CVE-2016-20011- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-20011
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.
- Record
DEBIAN-CVE-2016-20011- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-20011
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.
- Record
UBUNTU-CVE-2016-20011- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVMGASA-2021-0343 No score
Updated libgrss packages fix security vulnerability
libgrss does not perform any TLS certificate verification because it uses the deprecated SoupSessionAsync, which requires manually enabling certificate verification, rather than a modern SoupSession that has good defaults (CVE-2016-20011).
- Record
MGASA-2021-0343- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libgrssAlpine:v3.13 |
before 0.7.0-r1 | 0.7.0-r1 |
libgrssAlpine:v3.14 |
before 0.7.0-r1 | 0.7.0-r1 |
libgrssAlpine:v3.15 |
before 0.7.0-r1 | 0.7.0-r1 |
libgrssAlpine:v3.16 |
before 0.7.0-r1 | 0.7.0-r1 |
libgrssDebian:12 |
All versions, plus listed versions 0.7.0-20.7.0-2.10.7.0-2.1~exp1 |
None known |
libgrssMageia:7 |
before 0.7.0-2.1.mga7 | 0.7.0-2.1.mga7 |
libgrssMageia:8 |
before 0.7.0-4.1.mga8 | 0.7.0-4.1.mga8 |
libgrssUbuntu:16.04:LTS |
All versions, plus listed versions 0.5.0-30.7.0-10.7.0-2 |
None known |
libgrssUbuntu:18.04:LTS |
All versions, plus listed versions 0.7.0-2 |
None known |
libgrssUbuntu:20.04:LTS |
All versions, plus listed versions 0.7.0-2 |
None known |
libgrssUbuntu:22.04:LTS |
All versions, plus listed versions 0.7.0-2 |
None known |
libgrssUbuntu:24.04:LTS |
All versions, plus listed versions 0.7.0-20.7.0-2build10.7.0-2.1build10.7.0-2.1build2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-20011 is a high vulnerability (CVSS 7.5) in Gnome Libgrss, published May 25, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.44%, the 73rd percentile. Fixed in libgrss 0.7.0-r1.