GCVE - cpe:2.3:a:gnome:libgfbgraph:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:gnome:libgfbgraph:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Gnome (`0ee6d85f-ce9a-5064-936c-231d12a60ad5`)
Product	Libgfbgraph (`52f7c6f6-4176-517a-a191-a7c818542489`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/gfbgraph`	purl2cpe	2026-06-01 10:17:24.272576
`pkg:deb/ubuntu/gfbgraph`	purl2cpe	2026-06-01 10:17:24.272579
`pkg:github/gnome/libgfbgraph`	purl2cpe	2026-06-01 10:17:24.272582
`pkg:rpm/opensuse/libgfbgraph`	purl2cpe	2026-06-01 10:17:24.272585

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-39358`	vulnerable	2026-06-08 05:33:50.136515	Details available In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011. Published: 2021-08-22T18:47:08.000Z Updated: 2024-08-04T02:06:42.164Z Open on db.gcve.eu Reference links https://gitlab.gnome.org/GNOME/libgfbgraph/-/issues/17 https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYI47UX6S5PAOWVWQ2KID64MCTXTH7SE/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GRCVZUNPTNFQQQCEZVP7RYY6OKHPDBC5/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXXAF56BYLSES4UCLXKFCODZXTNAZ2G6/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.