LiveActive security incident?Get immediate response
CVE Record

CVE-2020-13645: In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verifica...

In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This flaw can make some GNOME glib-networking clients trust the wrong TLS certificate. If an application omits the expected server identity, certificates valid for unrelated hosts may be accepted. That weakens protection against impersonation for affected client applications.

Executive priority

Prioritize remediation where affected Linux desktop, mail, or GNOME-based client software handles sensitive communications over untrusted networks. Treat as important but not emergency without evidence of active exploitation.

Technical view

GNOME glib-networking through 2.64.2 GTlsClientConnection skipped hostname verification when the caller failed to set the expected server identity. Sources specifically call out Balsa before 2.5.11 and 2.6.x before 2.6.1 as affected applications.

Likely exposure

Exposure is likely on systems running glib-networking through 2.64.2 with applications that rely on GTlsClientConnection and omit server identity. Balsa versions listed in the CVE are directly named. Distribution advisories indicate packaged Linux impact.

Exploitation context

The bundle does not show CISA KEV listing or active exploitation. Practical risk depends on an affected client connecting over TLS while lacking a configured server identity, creating certificate hostname-verification failure conditions.

Researcher notes

The key condition is caller omission of server identity. The library behavior contradicted documented expectations to fail certificate verification. Assess real exposure by tracing affected callers, not just package presence.

Mitigation direction

  • Update glib-networking using your Linux vendor security advisories.
  • Upgrade Balsa to 2.5.11, 2.6.1, or later where applicable.
  • Identify applications using GTlsClientConnection and verify they set expected server identity.
  • Follow GNOME, distribution, and appliance vendor guidance for supported fixes.

Validation and detection

  • Inventory installed glib-networking package versions across endpoints and servers.
  • Check for Balsa versions before 2.5.11 or 2.6.1.
  • Review application code or dependencies for GTlsClientConnection server identity handling.
  • Confirm vendor advisory status for Fedora, Ubuntu, Gentoo, NetApp, and relevant distributions.
Prepared
Confidence
high
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-13645 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
9Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.