{"action":"Upgrade fossil to 1:2.15.2-1 or later.","affected":[{"fixed":"1:2.15.2-1","introduced":"0"}],"component":"fossil","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["1:2.15.2-1"],"id":"tcs_01M5NFTE6HN3VB2AD44YPG9R2W","modified_at":"2026-10-23T18:00:19.951061041Z","published_at":"2021-07-12T13:15:08.177Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2021-36377","https://security-tracker.debian.org/tracker/CVE-2021-36377"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2021-36377#Debian:13/fossil","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2021-36377"}],"summary":"Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation."}