VULNERABILITY INTELLIGENCE

CVE-2016-20011

CVSS score7.5 HIGH

EPSS probability1.43%

CISA KEVNot currently listed

Published2021-05-25

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.

Weakness classification

CWE-295: Improper Certificate Validation

Primary references

cve@mitre.org — Issue Tracking, Vendor Advisory
cve@mitre.org — Issue Tracking, Vendor Advisory
cve@mitre.org — Mailing List, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Patch, Vendor Advisory