CVE-2024-55581

NameCVE-2024-55581
DescriptionWhen AdaCore Ada Web Server 25.0.0 is linked with GnuTLS, the default behaviour of AWS.Client is vulnerable to a man-in-the-middle attack because of lack of verification of an HTTPS server's certificate (unless the using program specifies a TLS configuration).
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4080-1

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libawssourcebullseye20.2-2+deb11u1DLA-4080-1
libawssource(unstable)(unfixed)

Notes

https://docs.adacore.com/corp/security-advisories/SEC.AWS-0056-v1.pdf
Fixed by: https://github.com/AdaCore/aws/commit/3e9df7f8712112d653884610c7518cace6c16e41 (master)
Fixed by: https://github.com/AdaCore/aws/commit/30bccf02675c6022b061481c603f1da501e30572 (v25.1.0)
Followup (test renames): https://github.com/AdaCore/aws/commit/0616c672df44091bec69effd74867ed60d4ea866 (v25.1.0)
Search for package or bug name: Reporting problems