CVE-2020-6750

NameCVE-2020-6750
DescriptionGSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. NOTE: versions before 2.60 are unaffected.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs948554

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
glib2.0 (PTS)stretch2.50.3-2+deb9u2fixed
buster2.58.3-2+deb10u2fixed
bullseye, sid2.66.1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
glib2.0sourcejessie(not affected)
glib2.0sourcestretch(not affected)
glib2.0sourcebuster(not affected)
glib2.0source(unstable)2.62.5-1948554

Notes

[buster] - glib2.0 <not-affected> (Vulnerable code introduced later, regreession from 2.60.0)
[stretch] - glib2.0 <not-affected> (Vulnerable code introduced later, regreession from 2.60.0)
[jessie] - glib2.0 <not-affected> (Vulnerable code introduced later, regreession from 2.60.0)
https://gitlab.gnome.org/GNOME/glib/issues/1989

Search for package or bug name: Reporting problems