{"id":"CVE-2021-39365","aliases":["ALSA-2021:4339","DEBIAN-CVE-2021-39365","DLA-2762-1","DSA-4964-1","EUVD-2021-25726","GHSA-jvwp-xr6v-4m4f","MGASA-2021-0472","OESA-2021-1346","RHSA-2021:4339","RLSA-2021:4339","SUSE-SU-2021:3003-1","SUSE-SU-2021:3194-1","SUSE-SU-2021:3295-1","UBUNTU-CVE-2021-39365","USN-5055-1","openSUSE-SU-2021:1312-1","openSUSE-SU-2021:3194-1","openSUSE-SU-2024:10822-1"],"status":"published","title":"In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the...","description":"In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00866,"percentile":0.59159,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2021-08-22T21:18:23Z","modified":"2026-10-29T11:01:09Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"grilo","fixed_in":["0.3.6-3.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"grilo-devel","fixed_in":["0.3.6-3.el8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"grilo","fixed_in":["0.3.13-1.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"grilo","fixed_in":["0.3.13-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"grilo","fixed_in":["0.3.13-1.1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"grilo","fixed_in":["0.3.2-2+deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"grilo","fixed_in":["0.3.7-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"grilo","fixed_in":["0.3.13-1+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"grilo","fixed_in":["0.3.14-1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"grilo","fixed_in":["0.3.9-4.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"grilo","fixed_in":["0.3.9-4.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grilo","fixed_in":["0:0.3.6-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grilo-debuginfo","fixed_in":["0:0.3.6-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grilo-debugsource","fixed_in":["0:0.3.6-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"grilo-debuginfo","fixed_in":["0:0.3.6-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"grilo-debugsource","fixed_in":["0:0.3.6-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"grilo-devel","fixed_in":["0:0.3.6-3.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"grilo","fixed_in":["0:0.3.6-3.el8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"grilo","fixed_in":["0.3.2-7.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"grilo","fixed_in":["0.3.2-7.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"grilo","fixed_in":["0.3.2-7.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"grilo","fixed_in":["0.3.2-7.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"grilo","fixed_in":["0.3.12-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"grilo","fixed_in":["0.3.12-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP2","package":"grilo","fixed_in":["0.3.12-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"grilo","fixed_in":["0.3.12-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"grilo","fixed_in":["0.3.4-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"grilo","fixed_in":["0.3.4-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"grilo","fixed_in":["0.3.4-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"grilo","fixed_in":["0.3.4-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"grilo","fixed_in":["0.3.4-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"grilo","fixed_in":["0.3.4-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"grilo","fixed_in":["0.3.4-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"grilo","fixed_in":["0.3.4-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"grilo","fixed_in":["0.3.4-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"grilo","fixed_in":["0.3.4-3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"grilo","fixed_in":["0.2.15-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"grilo","fixed_in":["0.3.4-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"grilo","fixed_in":["0.3.12-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"grilo","fixed_in":["0.3.13-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"grilo","fixed_in":["0.3.12-lp152.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"grilo","fixed_in":["0.3.12-3.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-3.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grilo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-3.el8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.13-1.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.13-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.13-1.1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2-2+deb9u1"}]}],"versions":["0.3.2-2"]},{"source":"osv","ecosystem":"Debian:10","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.7-1+deb10u1"}]}],"versions":["0.3.7-1"]},{"source":"osv","ecosystem":"Debian:11","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.13-1+deb11u1"}]}],"versions":["0.3.13-1"]},{"source":"osv","ecosystem":"Mageia:8","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.14-1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.9-4.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.9-4.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.6-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grilo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.6-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grilo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.6-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"grilo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.6-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"grilo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.6-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"grilo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.6-3.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.6-3.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2-7.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2-7.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2-7.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2-7.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.12-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.12-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP2","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.12-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.12-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.4-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.4-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.4-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.4-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.4-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.4-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.4-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.4-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.4-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.4-3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.15-1ubuntu0.1~esm1"}]}],"versions":["0.2.14-1","0.2.15-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.4-1ubuntu0.1"}]}],"versions":["0.3.4-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.12-1ubuntu0.1"}]}],"versions":["0.3.10-1","0.3.11-1","0.3.12-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.13-1.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.15-1ubuntu0.1~esm1"}]}],"versions":["0.2.14-1","0.2.15-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.4-1ubuntu0.1"}]}],"versions":["0.3.4-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.12-1ubuntu0.1"}]}],"versions":["0.3.10-1","0.3.11-1","0.3.12-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.12-lp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"grilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.12-3.3.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"gnome","product":"grilo"}],"references":[{"url":"https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://gitlab.gnome.org/GNOME/grilo/-/issues/146","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Vendor Advisory","fix","report"]},{"url":"https://www.debian.org/security/2021/dsa-4964","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/09/msg00010.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39365","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jvwp-xr6v-4m4f"},{"url":"https://errata.almalinux.org/8/ALSA-2021-4339.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-39365","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-39365","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0472.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29423","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5055-1","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/BHNVKGOZ7O6L44VYMLWYH5RN63ALIRV2/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1346","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4339","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1997161","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4339.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-39365","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-39365","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4339","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213003-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1189839","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39365","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213194-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213295-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-39365","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BGUJWWBS4PDPSJUYSU34VIR2THULULQF/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7GPSQYWLYZXIWWGB3O5ZPKMPADF4ZWBO/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-39365","description":"In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.","status":"published","published":"2021-08-22T21:18:23Z","modified":"2024-08-04T02:06:42.403Z","updated_at":"2026-11-02T14:33:09.540052Z"}],"euvd":[{"id":"EUVD-2021-25726","description":"In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.","status":"published","published":"2021-08-22T21:18:23Z","modified":"2024-08-04T02:06:42Z","updated_at":"2026-11-03T03:24:23.719378Z"}],"ghsa":[{"id":"GHSA-jvwp-xr6v-4m4f","title":"In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the...","description":"In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.","status":"published","published":"2022-05-24T19:11:59Z","modified":"2023-01-30T05:01:38Z","cwes":["CWE-295"],"updated_at":"2026-11-02T14:46:27.385606Z"}],"nvd":[{"id":"CVE-2021-39365","description":"In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.","status":"published","published":"2021-08-22T22:15:07.29Z","modified":"2026-06-17T04:03:38.05Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:06:57.318236Z"}],"osv":[{"id":"CVE-2021-39365","description":"In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.","status":"published","published":"2021-08-22T22:15:07.29Z","modified":"2026-10-24T10:50:43.55655617Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:20.843843Z"},{"id":"DEBIAN-CVE-2021-39365","description":"In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.","status":"published","published":"2021-08-22T22:15:07.29Z","modified":"2026-10-23T18:05:23.481802094Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"OESA-2021-1346","title":"grilo security update","description":"Grilo is a framework focused on making media discovery and browsing easy for application developers.\r\n\r\nSecurity Fix(es):\r\n\r\nIn GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.(CVE-2021-39365)","status":"published","published":"2021-09-18T11:04:37Z","modified":"2026-08-18T01:15:55.517332373Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:4339","title":"Red Hat Security Advisory: grilo security update","status":"published","published":"2024-09-16T06:21:22Z","modified":"2026-06-26T12:21:14.728262473Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:4339","title":"Moderate: grilo security update","description":"Grilo is a framework that provides access to different sources of multimedia content, using a pluggable system. The grilo package contains the core library and elements.\n\nSecurity Fix(es):\n\n* grilo: missing TLS certificate verification (CVE-2021-39365)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T09:02:57Z","modified":"2026-02-04T13:30:09.308509Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-39365","description":"In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.","status":"published","published":"2021-08-22T22:15:00Z","modified":"2026-04-22T13:00:19.216332Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:28.526929Z"},{"id":"ALSA-2021:4339","title":"Moderate: grilo security update","description":"Grilo is a framework that provides access to different sources of multimedia content, using a pluggable system. The grilo package contains the core library and elements.\n\nSecurity Fix(es):\n\n* grilo: missing TLS certificate verification (CVE-2021-39365)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T09:02:57Z","modified":"2026-10-29T11:01:09.911048141Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DLA-2762-1","title":"grilo - security update","status":"published","published":"2021-09-22T00:00:00Z","modified":"2026-03-09T01:21:07.193935Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-4964-1","title":"grilo - security update","status":"published","published":"2021-08-27T00:00:00Z","modified":"2026-03-09T02:11:43.786184Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2021-0472","title":"Updated grilo packages fix security vulnerability","description":"Michael Catanzaro reported a problem in Grilo, a framework for discovering\nand browsing media. TLS certificate verification is not enabled on the\nSoupSessionAsync objects created by Grilo, leaving users vulnerable to\nnetwork MITM attacks.\n","status":"published","published":"2021-10-13T19:39:52Z","modified":"2026-04-16T04:40:58.063290635Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2021:1312-1","title":"Security update for grilo","description":"This update for grilo fixes the following issues:\n\n- CVE-2021-39365: Fixed missing TLS certificate verification (bsc#1189839).\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-09-28T05:11:52Z","modified":"2025-05-07T18:13:10.514437Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:3194-1","title":"Security update for grilo","description":"This update for grilo fixes the following issues:\n\n- CVE-2021-39365: Fixed missing TLS certificate verification (bsc#1189839).\n","status":"published","published":"2021-09-23T09:25:52Z","modified":"2026-02-04T03:58:21.135382Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:10822-1","title":"grilo-devel-0.3.13-2.2 on GA media","description":"These are all security issues fixed in the grilo-devel-0.3.13-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:13:10.638087Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2021:3003-1","title":"Security update for grilo","description":"This update for grilo fixes the following issues:\n\n- CVE-2021-39365: Fixed missing TLS certificate verification (bsc#1189839).\n","status":"published","published":"2021-09-09T13:20:32Z","modified":"2025-05-02T04:10:50.735855Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3194-1","title":"Security update for grilo","description":"This update for grilo fixes the following issues:\n\n- CVE-2021-39365: Fixed missing TLS certificate verification (bsc#1189839).\n","status":"published","published":"2021-09-23T09:25:51Z","modified":"2026-02-04T03:58:15.466229Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3295-1","title":"Security update for grilo","description":"This update for grilo fixes the following issues:\n\n- CVE-2021-39365: Fixed missing TLS certificate verification (bsc#1189839).\n","status":"published","published":"2021-10-06T14:50:04Z","modified":"2026-02-04T03:45:22.951011Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"USN-5055-1","title":"grilo vulnerability","description":"Michael Catanzaro discovered that grilo incorrectly handled certain TLS\ncertificate verification. An attacker could possibly use this issue to\nMITM attacks.\n","status":"published","published":"2021-08-30T12:17:47Z","modified":"2026-06-25T13:30:39.616253105Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}