CVE catalog

CVE-2016-20011

libgrss: CVE-2016-20011

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.44% · Oct 25, 2026

libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibgrssbookworm0.7.0-2vulnerable
Ubuntulibgrss16.040.5.0-3vulnerable
Ubuntulibgrss16.040.7.0-1vulnerable
Ubuntulibgrss16.040.7.0-2vulnerable
Ubuntulibgrss18.040.7.0-2vulnerable
Ubuntulibgrss20.040.7.0-2vulnerable
Ubuntulibgrss22.040.7.0-2vulnerable
Ubuntulibgrss24.040.7.0-2vulnerable
Ubuntulibgrss24.040.7.0-2build1vulnerable
Ubuntulibgrss24.040.7.0-2.1build1vulnerable
Ubuntulibgrss24.040.7.0-2.1build2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibgrsssourcebookworm(unfixed)not yet assignedNot reported[989149]

[Debian bug #989149]

Notes

[bookworm] libgrss: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [gir1.2-grss-0.7]Affected

    Source package: [libgrss]

    Details (2)

    • 0.7.0-2+b11 · amd64 · bookworm

      Affected

      dsa · libgrss · debian · bookworm; dsa · libgrss · debian · 12

    • 0.7.0-2+b11 · arm64 · bookworm

      Affected

      dsa · libgrss · debian · bookworm; dsa · libgrss · debian · 12

  • [libgrss0]Affected

    Source package: [libgrss]

    Details (2)

    • 0.7.0-2+b11 · amd64 · bookworm

      Affected

      dsa · libgrss · debian · bookworm; dsa · libgrss · debian · 12

    • 0.7.0-2+b11 · arm64 · bookworm

      Affected

      dsa · libgrss · debian · bookworm; dsa · libgrss · debian · 12

  • [libgrss-dev]Affected

    Source package: [libgrss]

    Details (2)

    • 0.7.0-2+b11 · amd64 · bookworm

      Affected

      dsa · libgrss · debian · bookworm; dsa · libgrss · debian · 12

    • 0.7.0-2+b11 · arm64 · bookworm

      Affected

      dsa · libgrss · debian · bookworm; dsa · libgrss · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]