Vulnerability Details : CVE-2020-6750
Potential exploit
GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. NOTE: versions before 2.60 are unaffected.
Products affected by CVE-2020-6750
- cpe:2.3:a:gnome:glib:*:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-6750
0.29%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 69 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-6750
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:N |
8.6
|
2.9
|
NIST | |
5.9
|
MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
2.2
|
3.6
|
NIST |
References for CVE-2020-6750
-
https://bugzilla.suse.com/show_bug.cgi?id=1160668
Bug 1160668 – VUL-1: CVE-2020-6750: glib2: GSocketClient may occasionally connect directly to a target address instead of connecting via a proxy serverIssue Tracking;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEM7MMAXMWCDPUH4MTUZ763MBB64RRLJ/
[SECURITY] Fedora 31 Update: mingw-glib2-2.62.4-2.fc31 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RIFEDSRJ4P3WFCMDUOFQ2LEILZLMDW7/
[SECURITY] Fedora 31 Update: glib2-2.62.4-2.fc31 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJMLGW55HOQXHMTIPH2PWXFRBNBWVO4W/
[SECURITY] Fedora 30 Update: glib2-2.60.7-3.fc30 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://gitlab.gnome.org/GNOME/glib/issues/1989
Socks5 Proxy: Proxy on a SocketClient set via set_proxy_resolver ignored (#1989) · Issues · GNOME / GLib · GitLabExploit;Issue Tracking;Vendor Advisory
-
https://security.netapp.com/advisory/ntap-20200127-0001/
CVE-2020-6750 GNOME GLib Vulnerability in NetApp Products | NetApp Product SecurityThird Party Advisory
Jump to