LiveActive security incident?Get immediate response
CVE Record

CVE-2021-39359: In GNOME libgda through 6.0.0, gda-web-provider.c does not enable TLS certificate verification on the SoupS...

In GNOME libgda through 6.0.0, gda-web-provider.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

GNOME libgda through 6.0.0 created certain web-provider network sessions without checking TLS certificates. That can let an attacker with network interception capability impersonate a server and read or alter traffic that users expected to be protected by HTTPS.

Executive priority

Treat this as a targeted remediation item, not an emergency based on current evidence. Prioritize systems where libgda handles sensitive data over networks, especially laptops, shared networks, or environments exposed to interception risk.

Technical view

The flaw is in gda-web-provider.c: SoupSessionSync objects were created without enabling TLS certificate verification. Sources describe the issue as exposing users to network man-in-the-middle attacks and note similarity to CVE-2016-20011. A GNOME commit and Fedora advisories are referenced.

Likely exposure

Exposure is most likely where applications use vulnerable GNOME libgda web-provider functionality on systems running libgda through 6.0.0. The bundle does not provide CPEs, package version ranges by distribution, or evidence that all libgda deployments use the affected path.

Exploitation context

The bundle does not show CISA KEV listing or cited evidence of active exploitation. Practical exploitation depends on a network-positioned attacker and a victim workflow that uses the affected libgda web provider over TLS.

Researcher notes

Source data is incomplete: no CVSS, CWE, CPEs, or exploit telemetry are provided. The core security issue is missing TLS certificate verification in SoupSessionSync usage, with an upstream commit and Fedora advisories available for remediation tracking.

Mitigation direction

  • Apply vendor libgda updates referenced by your operating system or distribution.
  • For Fedora systems, review the two Fedora 2021 package advisories in the bundle.
  • If building from source, include the upstream GNOME libgda fix commit.
  • Check current GNOME or distribution guidance before assuming a complete fix.
  • Reduce use of untrusted networks for affected workflows until patched.

Validation and detection

  • Inventory systems and applications with GNOME libgda installed.
  • Identify whether the libgda web provider is used in production workflows.
  • Confirm installed packages are newer than vulnerable vendor builds.
  • Review gda-web-provider.c to verify TLS certificate verification is enabled.
  • Check distribution advisory status for each affected operating system image.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-39359 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.