]> code.ossystems Code Review - openembedded-core.git/commit
glib-2.0: fix CVE-2020-6750
authorhaiqing <haiqing.bai@windriver.com>
Fri, 27 Mar 2020 02:38:05 +0000 (10:38 +0800)
committerAnuj Mittal <anuj.mittal@intel.com>
Mon, 6 Apr 2020 07:17:05 +0000 (15:17 +0800)
commit29ed9fc7341cc3db716115aef1a6910fdb893145
tree1554f1091e031db0349a1c8126d549270a5e6d6c
parent88cce1d9d06ed4c5a7b58a31d75cfd1503605df9
glib-2.0: fix CVE-2020-6750

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly
to a target address instead of connecting via a proxy server when configured
to do so, because the proxy_addr field is mishandled. This bug is timing-dependent
and may occur only sporadically depending on network delays. The greatest security
relevance is in use cases where a proxy is used to help with privacy/anonymity,
even though there is no technical barrier to a direct connection.

Signed-off-by: Haiqing Bai <Haiqing.Bai@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
meta/recipes-core/glib-2.0/glib-2.0/CVE-2020-6750.patch [new file with mode: 0644]
meta/recipes-core/glib-2.0/glib-2.0_2.60.7.bb