{"id":"CVE-2016-20011","aliases":["ALPINE-CVE-2016-20011","DEBIAN-CVE-2016-20011","EUVD-2016-3099","GHSA-x2mc-pw6q-5pv7","MGASA-2021-0343","UBUNTU-CVE-2016-20011"],"status":"published","title":"libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds,...","description":"libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01441,"percentile":0.73378,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2021-05-25T20:09:43Z","modified":"2026-11-03T06:30:03Z","fixes":[{"ecosystem":"Alpine:v3.13","package":"libgrss","fixed_in":["0.7.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"libgrss","fixed_in":["0.7.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"libgrss","fixed_in":["0.7.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"libgrss","fixed_in":["0.7.0-r1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"libgrss","fixed_in":["0.7.0-2.1.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"libgrss","fixed_in":["0.7.0-4.1.mga8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"libgrss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"libgrss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"libgrss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"libgrss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libgrss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.0-2","0.7.0-2.1","0.7.0-2.1~exp1"]},{"source":"osv","ecosystem":"Mageia:7","package":"libgrss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-2.1.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"libgrss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-4.1.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libgrss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.0-3","0.7.0-1","0.7.0-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libgrss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.0-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libgrss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.0-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libgrss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libgrss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.0-2","0.7.0-2build1","0.7.0-2.1build1","0.7.0-2.1build2"]}],"products":[{"vendor":"gnome","product":"libgrss"}],"references":[{"url":"https://bugzilla.gnome.org/show_bug.cgi?id=772647","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://gitlab.gnome.org/GNOME/libgrss/-/issues/4","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://gitlab.gnome.org/GNOME/libgrss/-/merge_requests/7.patch","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Vendor Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-20011"},{"url":"https://github.com/advisories/GHSA-x2mc-pw6q-5pv7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-20011","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-20011","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0343.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29092","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-20011","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-20011","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-20011","description":"libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.","status":"published","published":"2021-05-25T20:09:43Z","modified":"2024-08-06T03:47:35.031Z","updated_at":"2026-11-02T14:33:30.359814Z"}],"euvd":[{"id":"EUVD-2016-3099","description":"libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.","status":"published","published":"2021-05-25T20:09:43Z","modified":"2024-08-06T03:47:35Z","updated_at":"2026-11-03T02:22:21.756675Z"}],"ghsa":[{"id":"GHSA-x2mc-pw6q-5pv7","title":"libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds,...","description":"libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.","status":"published","published":"2022-05-24T19:03:09Z","modified":"2023-01-29T05:06:47Z","cwes":["CWE-295"],"updated_at":"2026-11-02T14:46:05.929333Z"}],"nvd":[{"id":"CVE-2016-20011","description":"libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.","status":"published","published":"2021-05-25T21:15:07.29Z","modified":"2026-06-17T00:43:04.94Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:03:40.524348Z"}],"osv":[{"id":"ALPINE-CVE-2016-20011","description":"libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.","status":"published","published":"2021-05-25T21:15:07.29Z","modified":"2026-11-03T06:30:03.355803724Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T06:41:39.834803Z"},{"id":"CVE-2016-20011","description":"libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.","status":"published","published":"2021-05-25T21:15:07.29Z","modified":"2026-04-16T04:43:49.651115454Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-20011","description":"libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.","status":"published","published":"2021-05-25T21:15:07.29Z","modified":"2026-09-22T07:01:28.132097329Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2016-20011","description":"libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.","status":"published","published":"2021-05-25T21:15:00Z","modified":"2026-04-22T10:35:39.937175Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"MGASA-2021-0343","title":"Updated libgrss packages fix security vulnerability","description":"libgrss does not perform any TLS certificate verification because it uses the\ndeprecated SoupSessionAsync, which requires manually enabling certificate\nverification, rather than a modern SoupSession that has good defaults\n(CVE-2016-20011).\n","status":"published","published":"2021-07-12T20:26:21Z","modified":"2026-04-16T04:44:23.860107287Z","updated_at":"2026-11-02T15:49:41.509337Z"}]}}