CVE-2020-6750

09.01.2020, 20:15

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. NOTE: versions before 2.60 are unaffected.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.9 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 69%

Affected Products (NVD)

Vendor	Product	Version
gnome	glib	2.60.0 ≤ 𝑥 ≤ 2.62.4

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

glib2.0

bookworm	2.74.6-2+deb12u3 fixed
bookworm (security)	2.74.6-2+deb12u2 fixed
bullseye	2.66.8-1+deb11u4 fixed
bullseye (security)	2.66.8-1+deb11u3 fixed
buster	not-affected
jessie	not-affected
sid	2.82.2-2 fixed
stretch	not-affected
trixie	2.82.2-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

glib2.0

bionic	not-affected
disco	ignored
eoan	ignored
focal	not-affected
trusty	not-affected
xenial	not-affected

openSUSE / SLES Releases

openSUSE Product

Release

glib2-devel

suse enterprise desktop 15 SP2	2.62.5-1.26 fixed
suse enterprise desktop 15 SP3	2.62.6-3.6.1 fixed
suse enterprise desktop 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise desktop 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise desktop 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise desktop 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise sap 15 SP2	2.62.5-1.26 fixed
suse enterprise sap 15 SP3	2.62.6-3.6.1 fixed
suse enterprise sap 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise sap 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise sap 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise sap 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise server 15 SP2	2.62.5-1.26 fixed
suse enterprise server 15 SP3	2.62.6-3.6.1 fixed
suse enterprise server 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise server 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise server 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise server 15 SP7	2.78.6-150600.4.11.1 fixed

glib2-lang

suse enterprise desktop 15 SP2	2.62.5-1.26 fixed
suse enterprise desktop 15 SP3	2.62.6-3.6.1 fixed
suse enterprise desktop 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise desktop 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise desktop 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise desktop 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise sap 15 SP2	2.62.5-1.26 fixed
suse enterprise sap 15 SP3	2.62.6-3.6.1 fixed
suse enterprise sap 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise sap 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise sap 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise sap 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise server 15 SP2	2.62.5-1.26 fixed
suse enterprise server 15 SP3	2.62.6-3.6.1 fixed
suse enterprise server 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise server 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise server 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise server 15 SP7	2.78.6-150600.4.11.1 fixed

glib2-tools

suse enterprise desktop 15 SP2	2.62.5-1.26 fixed
suse enterprise desktop 15 SP3	2.62.6-3.6.1 fixed
suse enterprise desktop 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise desktop 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise desktop 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise desktop 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise sap 15 SP2	2.62.5-1.26 fixed
suse enterprise sap 15 SP3	2.62.6-3.6.1 fixed
suse enterprise sap 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise sap 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise sap 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise sap 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise server 15 SP2	2.62.5-1.26 fixed
suse enterprise server 15 SP3	2.62.6-3.6.1 fixed
suse enterprise server 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise server 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise server 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise server 15 SP7	2.78.6-150600.4.11.1 fixed

libgio-2_0-0

suse enterprise desktop 15 SP2	2.62.5-1.26 fixed
suse enterprise desktop 15 SP3	2.62.6-3.6.1 fixed
suse enterprise desktop 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise desktop 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise desktop 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise desktop 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise sap 15 SP2	2.62.5-1.26 fixed
suse enterprise sap 15 SP3	2.62.6-3.6.1 fixed
suse enterprise sap 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise sap 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise sap 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise sap 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise server 15 SP2	2.62.5-1.26 fixed
suse enterprise server 15 SP3	2.62.6-3.6.1 fixed
suse enterprise server 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise server 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise server 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise server 15 SP7	2.78.6-150600.4.11.1 fixed

libgio-2_0-0-32bit

suse enterprise desktop 15 SP2	2.62.5-1.26 fixed
suse enterprise desktop 15 SP3	2.62.6-3.6.1 fixed
suse enterprise desktop 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise desktop 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise desktop 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise desktop 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise sap 15 SP2	2.62.5-1.26 fixed
suse enterprise sap 15 SP3	2.62.6-3.6.1 fixed
suse enterprise sap 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise sap 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise sap 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise sap 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise server 15 SP2	2.62.5-1.26 fixed
suse enterprise server 15 SP3	2.62.6-3.6.1 fixed
suse enterprise server 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise server 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise server 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise server 15 SP7	2.78.6-150600.4.11.1 fixed

libglib-2_0-0

suse enterprise desktop 15 SP2	2.62.5-1.26 fixed
suse enterprise desktop 15 SP3	2.62.6-3.6.1 fixed
suse enterprise desktop 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise desktop 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise desktop 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise desktop 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise sap 15 SP2	2.62.5-1.26 fixed
suse enterprise sap 15 SP3	2.62.6-3.6.1 fixed
suse enterprise sap 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise sap 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise sap 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise sap 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise server 15 SP2	2.62.5-1.26 fixed
suse enterprise server 15 SP3	2.62.6-3.6.1 fixed
suse enterprise server 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise server 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise server 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise server 15 SP7	2.78.6-150600.4.11.1 fixed

libglib-2_0-0-32bit

suse enterprise desktop 15 SP2	2.62.5-1.26 fixed
suse enterprise desktop 15 SP3	2.62.6-3.6.1 fixed
suse enterprise desktop 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise desktop 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise desktop 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise desktop 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise sap 15 SP2	2.62.5-1.26 fixed
suse enterprise sap 15 SP3	2.62.6-3.6.1 fixed
suse enterprise sap 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise sap 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise sap 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise sap 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise server 15 SP2	2.62.5-1.26 fixed
suse enterprise server 15 SP3	2.62.6-3.6.1 fixed
suse enterprise server 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise server 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise server 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise server 15 SP7	2.78.6-150600.4.11.1 fixed

libgmodule-2_0-0

suse enterprise desktop 15 SP2	2.62.5-1.26 fixed
suse enterprise desktop 15 SP3	2.62.6-3.6.1 fixed
suse enterprise desktop 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise desktop 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise desktop 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise desktop 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise sap 15 SP2	2.62.5-1.26 fixed
suse enterprise sap 15 SP3	2.62.6-3.6.1 fixed
suse enterprise sap 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise sap 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise sap 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise sap 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise server 15 SP2	2.62.5-1.26 fixed
suse enterprise server 15 SP3	2.62.6-3.6.1 fixed
suse enterprise server 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise server 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise server 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise server 15 SP7	2.78.6-150600.4.11.1 fixed

libgmodule-2_0-0-32bit

suse enterprise desktop 15 SP2	2.62.5-1.26 fixed
suse enterprise desktop 15 SP3	2.62.6-3.6.1 fixed
suse enterprise desktop 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise desktop 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise desktop 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise desktop 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise sap 15 SP2	2.62.5-1.26 fixed
suse enterprise sap 15 SP3	2.62.6-3.6.1 fixed
suse enterprise sap 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise sap 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise sap 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise sap 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise server 15 SP2	2.62.5-1.26 fixed
suse enterprise server 15 SP3	2.62.6-3.6.1 fixed
suse enterprise server 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise server 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise server 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise server 15 SP7	2.78.6-150600.4.11.1 fixed

libgobject-2_0-0

suse enterprise desktop 15 SP2	2.62.5-1.26 fixed
suse enterprise desktop 15 SP3	2.62.6-3.6.1 fixed
suse enterprise desktop 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise desktop 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise desktop 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise desktop 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise sap 15 SP2	2.62.5-1.26 fixed
suse enterprise sap 15 SP3	2.62.6-3.6.1 fixed
suse enterprise sap 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise sap 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise sap 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise sap 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise server 15 SP2	2.62.5-1.26 fixed
suse enterprise server 15 SP3	2.62.6-3.6.1 fixed
suse enterprise server 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise server 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise server 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise server 15 SP7	2.78.6-150600.4.11.1 fixed

libgobject-2_0-0-32bit

suse enterprise desktop 15 SP2	2.62.5-1.26 fixed
suse enterprise desktop 15 SP3	2.62.6-3.6.1 fixed
suse enterprise desktop 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise desktop 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise desktop 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise desktop 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise sap 15 SP2	2.62.5-1.26 fixed
suse enterprise sap 15 SP3	2.62.6-3.6.1 fixed
suse enterprise sap 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise sap 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise sap 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise sap 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise server 15 SP2	2.62.5-1.26 fixed
suse enterprise server 15 SP3	2.62.6-3.6.1 fixed
suse enterprise server 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise server 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise server 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise server 15 SP7	2.78.6-150600.4.11.1 fixed

libgthread-2_0-0

suse enterprise desktop 15 SP2	2.62.5-1.26 fixed
suse enterprise desktop 15 SP3	2.62.6-3.6.1 fixed
suse enterprise desktop 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise desktop 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise desktop 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise desktop 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise sap 15 SP2	2.62.5-1.26 fixed
suse enterprise sap 15 SP3	2.62.6-3.6.1 fixed
suse enterprise sap 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise sap 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise sap 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise sap 15 SP7	2.78.6-150600.4.11.1 fixed
suse enterprise server 15 SP2	2.62.5-1.26 fixed
suse enterprise server 15 SP3	2.62.6-3.6.1 fixed
suse enterprise server 15 SP4	2.70.4-150400.1.5 fixed
suse enterprise server 15 SP5	2.70.5-150400.3.8.1 fixed
suse enterprise server 15 SP6	2.78.3-150600.2.2 fixed
suse enterprise server 15 SP7	2.78.6-150600.4.11.1 fixed

Known Exploits!

References

https://bugzilla.suse.com/show_bug.cgi?id=1160668

https://gitlab.gnome.org/GNOME/glib/issues/1989

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5RIFEDSRJ4P3WFCMDUOFQ2LEILZLMDW7/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJMLGW55HOQXHMTIPH2PWXFRBNBWVO4W/