Security readout for executives and security teams
Plain-English summary
GNOME evolution-rss failed to verify TLS certificates for some network sessions. A person able to intercept a user's network traffic could impersonate HTTPS feed servers or alter feed data. This is mainly a desktop/client-side exposure, not a remotely exploitable server flaw. Sources do not provide CVSS, KEV, or confirmed exploitation.
Executive priority
Treat this as a moderate desktop application risk. It matters most for users handling sensitive feed content or operating on hostile networks, but available evidence does not indicate widespread active exploitation or server-side business disruption.
Technical view
GNOME evolution-rss through 0.3.96 creates SoupSessionSync objects in network-soup.c without enabling TLS certificate verification. Because SoupSessionSync/SoupSessionAsync defaulted to no verification, HTTPS connections could accept untrusted certificates, enabling man-in-the-middle tampering or eavesdropping by an attacker with network path control.
Likely exposure
Exposure is limited to systems running GNOME evolution-rss through 0.3.96, especially users fetching RSS feeds over untrusted networks. The source bundle does not identify package names, distributions, or fixed versions.
Exploitation context
No cited source states active exploitation, and the CVE is not listed as KEV. Exploitation would require a network man-in-the-middle position between the user and RSS feed endpoints.
Researcher notes
The core issue is missing TLS certificate verification on SoupSessionSync objects in network-soup.c. Evidence is sparse: no CVSS vector, CWE, fixed version, or exploit telemetry is provided in the source bundle. Similarity to CVE-2016-20011 is noted by the CVE description.
Mitigation direction
- Inventory systems with GNOME evolution-rss installed.
- Check vendor or distribution advisories for a fixed evolution-rss package.
- Prioritize updates for users on public or untrusted networks.
- Avoid using affected clients for sensitive feeds until remediated.
- Use trusted networks or VPN controls as compensating risk reduction.
Validation and detection
- Confirm installed evolution-rss version is not through 0.3.96.
- Review distribution changelogs for CVE-2021-39361 or TLS verification fixes.
- Verify vendor guidance before declaring remediation complete.
- Check whether affected users fetch RSS feeds over HTTPS on untrusted networks.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-39361 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification/CVE reference · x_refsource_MISC
- https://gitlab.gnome.org/GNOME/evolution-rss/-/issues/11CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.