CVE-2016-1000033 — Improper Certificate Validation in Shotwell

CWE-295 — Improper Certificate Validation7 documents6 sources
Severity
3.7LOWNVD
EPSS
0.4%
top 38.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Gnome ShotwellDebian ShotwellRedhat Enterprise Linux
Timeline
PublishedOct 25
Latest updateMay 13

Description

Shotwell version 0.22.0 (and possibly other versions) is vulnerable to a TLS/SSL certification validation flaw resulting in a potential for man in the middle attacks.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 2.2 | Impact: 1.4

Affected Packages3 packages

▶debiandebian/shotwell< shotwell 0.22.0-3 (bookworm)
▶Debiangnome/shotwell< 0.22.0-3+3
▶NVDgnome/shotwell0.22.0

Also affects: Enterprise Linux 7.0

🔴Vulnerability Details

2
GHSA
GHSA-9hvv-q3hq-r4f2: Shotwell version 0↗2022-05-13
▶
OSV
CVE-2016-1000033: Shotwell version 0↗2016-10-25
▶

📋Vendor Advisories

2
Debian
CVE-2016-1000033: shotwell - Shotwell version 0.22.0 (and possibly other versions) is vulnerable to a TLS/SSL...↗2016
▶
Red Hat
shotwell: TLS certificates are not validated when publishing photos to external services↗2015-09-02
▶

💬Community

2
Bugzilla
CVE-2016-1000033 shotwell: TLS certificates are not validated when publishing photos to external services [fedora-all]↗2015-12-14
▶
Bugzilla
CVE-2016-1000033 shotwell: TLS certificates are not validated when publishing photos to external services↗2015-12-14
▶