CVE-2013-0240

Name of the Vulnerable Software and Affected Versions Gnome Online Accounts (GOA) versions 3.4.x through 3.7.x before 3.7.5 Gnome Online Accounts (GOA) versions 3.6.x before 3.6.3

Description The issue allows man-in-the-middle attackers to obtain sensitive information, such as credentials, by sniffing the network. This is due to the improper validation of SSL certificates when creating accounts.

Recommendations For Gnome Online Accounts (GOA) versions 3.4.x, update to version 3.7.5 or later to resolve the issue. For Gnome Online Accounts (GOA) versions 3.6.x before 3.6.3, update to version 3.6.3 or later to resolve the issue. As a temporary workaround, consider disabling the creation of new online accounts until a patch is available.