GLib Networking was not properly verifying TLS certificates in all circumstances, possibly allowing an integrity/confidentiality compromise.
|Package||net-libs/glib-networking on all architectures|
|Affected versions||< 2.62.4|
|Unaffected versions||>= 2.62.4|
Network-related giomodules for glib
GTlsClientConnection skips hostname verification of the server’s TLS certificate if the application fails to specify the expected server identity.
There may be a breach of integrity or confidentiality in connections made using GLib Networking.
There is no known workaround at this time.
All GLib Networking users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/glib-networking-2.62.4"
July 27, 2020
July 27, 2020: 1