CVE-2020-6750
low-risk
Published 2020-01-09
GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. NOTE: versions before 2.60 are unaffected.
Do I need to act?
-
0.59% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.9/10
Medium
NETWORK
/ HIGH complexity
Affected Vendors
References (12)
Issue Tracking
https://bugzilla.suse.com/show_bug.cgi?id=1160668
Third Party Advisory
https://security.netapp.com/advisory/ntap-20200127-0001/
Issue Tracking
https://bugzilla.suse.com/show_bug.cgi?id=1160668
Third Party Advisory
https://security.netapp.com/advisory/ntap-20200127-0001/
29
/ 100
low-risk
Severity
18/34 · Moderate
Exploitability
2/34 · Minimal
Exposure
9/34 · Low