CVE-2013-1799

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-04-02 · updated 2026-06-16
Weakness: CWE-310

Description

Gnome Online Accounts (GOA) 3.6.x before 3.6.3 and 3.7.x before 3.7.91, does not properly validate SSL certificates when creating accounts for providers who use the libsoup library, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network. NOTE: this issue exists because of an incomplete fix for CVE-2013-0240.

Affected products

Canonical Ubuntu Linux: 11.10, 12.04, 12.10
Gnome Online Accounts: 3.6.0, 3.6.1, 3.6.2, 3.7.1, 3.7.2, 3.7.3 (+2)

References

http://lists.opensuse.org/opensuse-updates/2013-02/msg00046.html
http://secunia.com/advisories/51976
http://secunia.com/advisories/52791
http://ubuntu.com/usn/usn-1779-1
https://bugzilla.gnome.org/show_bug.cgi?id=693214
https://bugzilla.gnome.org/show_bug.cgi?id=695106
https://git.gnome.org/browse/gnome-online-accounts/commit/?id=9cf4bc0ced2c53bcdd36922caa65afc8a167bbd8
https://mail.gnome.org/archives/gnome-announce-list/2013-March/msg00007.html
https://mail.gnome.org/archives/gnome-announce-list/2013-March/msg00020.html
http://lists.opensuse.org/opensuse-updates/2013-02/msg00046.html
http://secunia.com/advisories/51976
http://secunia.com/advisories/52791

Get alerted when CVE-2013-1799 or the next vulnerability affects your stack