CVE-2016-20011
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds,...
CVE-2016-20011 is a high vulnerability (CVSS 7.5) in Gnome Libgrss, published May 25, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.44%, the 73rd percentile. Fixed in libgrss 0.7.0-r1.
- Severity
- 7.5 HighCVSS 3.1, NVD
- Exploit chance
- 1.44%EPSS, 73rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.7.0-r1libgrss +11 more
Description
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libgrssAlpine:v3.13 | before 0.7.0-r1 | 0.7.0-r1 |
libgrssAlpine:v3.14 | before 0.7.0-r1 | 0.7.0-r1 |
libgrssAlpine:v3.15 | before 0.7.0-r1 | 0.7.0-r1 |
libgrssAlpine:v3.16 | before 0.7.0-r1 | 0.7.0-r1 |
libgrssDebian:12 | All versions, plus listed versions 0.7.0-20.7.0-2.10.7.0-2.1~exp1 | None known |
libgrssMageia:7 | before 0.7.0-2.1.mga7 | 0.7.0-2.1.mga7 |
libgrssMageia:8 | before 0.7.0-4.1.mga8 | 0.7.0-4.1.mga8 |
libgrssUbuntu:16.04:LTS | All versions, plus listed versions 0.5.0-30.7.0-10.7.0-2 | None known |
libgrssUbuntu:18.04:LTS | All versions, plus listed versions 0.7.0-2 | None known |
libgrssUbuntu:20.04:LTS | All versions, plus listed versions 0.7.0-2 | None known |
libgrssUbuntu:22.04:LTS | All versions, plus listed versions 0.7.0-2 | None known |
libgrssUbuntu:24.04:LTS | All versions, plus listed versions 0.7.0-20.7.0-2build10.7.0-2.1build10.7.0-2.1build2 | None known |
What each source reports
NVD Score used
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.
- Record
CVE-2016-20011- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE ListNo score
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.
- Record
CVE-2016-20011- Updated
- 2026-11-02
EUVDEUVD-2016-3099No score
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.
- Record
EUVD-2016-3099- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x2mc-pw6q-5pv7No score
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds,...
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.
- Record
GHSA-x2mc-pw6q-5pv7- Weakness
- CWE-295
- Updated
- 2026-11-02
OSVALPINE-CVE-2016-20011
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.
- Record
ALPINE-CVE-2016-20011- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
OSV
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.
- Record
CVE-2016-20011- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-20011
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.
- Record
DEBIAN-CVE-2016-20011- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-20011
libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.
- Record
UBUNTU-CVE-2016-20011- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVMGASA-2021-0343No score
Updated libgrss packages fix security vulnerability
libgrss does not perform any TLS certificate verification because it uses the deprecated SoupSessionAsync, which requires manually enabling certificate verification, rather than a modern SoupSession that has good defaults (CVE-2016-20011).
- Record
MGASA-2021-0343- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.