{"id":"CVE-2021-36377","aliases":["DEBIAN-CVE-2021-36377","EUVD-2021-22993","GHSA-4cqm-xv6v-78c5","MGASA-2021-0491","UBUNTU-CVE-2021-36377"],"status":"published","title":"Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS...","description":"Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00574,"percentile":0.47891,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2021-07-12T12:11:49Z","modified":"2026-10-23T18:00:19Z","fixes":[{"ecosystem":"Debian:12","package":"fossil","fixed_in":["1:2.15.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"fossil","fixed_in":["1:2.15.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"fossil","fixed_in":["1:2.15.2-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"fossil","fixed_in":["2.14.2-1.mga8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"fossil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.15.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"fossil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.15.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"fossil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.15.2-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"fossil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.2-1.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"fossil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.33-3","1:1.33-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"fossil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.2-1","1:2.4-1","1:2.4-1build1","1:2.5-1","1:2.5-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"fossil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.8-1","1:2.10-1","1:2.10-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"fossil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.15.2-1","1:2.16-3","1:2.16-3build1","1:2.17-1","1:2.17-2","1:2.18-1","1:2.18-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"fossil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.22-1","1:2.22-2","1:2.23-1","1:2.23-1build1","1:2.23-1build2","1:2.23-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"fossil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.24-6","1:2.26-1","1:2.26-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"fossil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.26-2","1:2.28-1","1:2.28-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"fossil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.26-2"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"fossil-scm","product":"fossil"}],"references":[{"url":"https://fossil-scm.org/forum/forumpost/8d367e16f53d93c789d70bd3bf2c9587227bbd5c6a7b8e512cccd79007536036","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBTRZ5HCOUTIIKJF3T37NORI4P7EVYCY/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-36377"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JBTRZ5HCOUTIIKJF3T37NORI4P7EVYCY/"},{"url":"https://github.com/advisories/GHSA-4cqm-xv6v-78c5"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-36377","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0491.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29266","tags":["report"]},{"url":"https://fossil-scm.org/home/doc/trunk/www/changes.wiki#v2_14","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/AQ44KVDTB6D2MENE7C2YPVCSV3BXT3B4/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/JBTRZ5HCOUTIIKJF3T37NORI4P7EVYCY/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-36377","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-36377","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-36377","description":"Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation.","status":"published","published":"2021-07-12T12:11:49Z","modified":"2024-08-04T00:54:51.436Z","updated_at":"2026-11-02T14:33:06.32268Z"}],"euvd":[{"id":"EUVD-2021-22993","description":"Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation.","status":"published","published":"2021-07-12T12:11:49Z","modified":"2024-08-04T00:54:51Z","updated_at":"2026-11-03T03:24:29.877227Z"}],"ghsa":[{"id":"GHSA-4cqm-xv6v-78c5","title":"Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS...","description":"Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation.","status":"published","published":"2022-05-24T19:07:31Z","modified":"2023-01-30T05:00:40Z","cwes":["CWE-295"],"updated_at":"2026-11-02T14:46:15.397604Z"}],"nvd":[{"id":"CVE-2021-36377","description":"Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation.","status":"published","published":"2021-07-12T13:15:08.177Z","modified":"2026-06-17T03:58:46.49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:06:55.747384Z"}],"osv":[{"id":"CVE-2021-36377","description":"Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation.","status":"published","published":"2021-07-12T13:15:08.177Z","modified":"2026-04-16T04:42:16.760911755Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:20.434873Z"},{"id":"DEBIAN-CVE-2021-36377","description":"Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation.","status":"published","published":"2021-07-12T13:15:08.177Z","modified":"2026-10-23T18:00:19.951061041Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"UBUNTU-CVE-2021-36377","description":"Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation.","status":"published","published":"2021-07-12T13:15:00Z","modified":"2026-10-17T12:56:20.438516316Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:27.870979Z"},{"id":"MGASA-2021-0491","title":"Updated fossil packages fix security vulnerability","description":"Client-side TLS so that it verifies that the server hostname matches its\ncertificate (Fixed in fossil 2.14.2).\n\nA data exfiltration bug in the server (Fixed in fossil 2.14.1).\n","status":"published","published":"2021-10-27T12:13:28Z","modified":"2026-04-16T04:42:35.122638067Z","updated_at":"2026-11-02T15:49:41.849028Z"}]}}