{“lastseen”:””,”description”:”dde-control-center is the control panel of DDE, the Deepin Desktop Environment. plugin-deepinid is a plugin in dde-control-center, which provides the deepinid cloud service. Prior to 6.1.80, plugin-deepinid is configured to skip TLS certificate verification when fetching the user’s avatar from openapi.deepin.com or other providers. An MITM attacker could intercept the traffic, replace the avatar with a malicious or misleading image, and potentially identify the user by the avatar. This vulnerability is fixed in dde-control-center 6.1.80 and 5.9.9.”,”published”:”2026-04-09T17:48:07.637Z”,”modified”:”2026-04-09T17:48:07.637Z”,”type”:”cve”,”title”:”deepinid plugin in dde-control-center is configured to skip TLS certificate verification when downloading avatar from remote server”,”source”:”GitHub_M”,”references”:”https:\/\/github.com\/linuxdeepin\/developer-center\/security\/advisories\/GHSA-jf2h-4vqc-3jgc\\nhttps:\/\/github.com\/linuxdeepin\/dde-control-center\/pull\/3146\\nhttps:\/\/github.com\/linuxdeepin\/dde-control-center\/commit\/6fc206120be28d9eef7d72258662bcabb834367f\\nhttps:\/\/github.com\/linuxdeepin\/dde-control-center\/commit\/cd95b054ff10a35bc9284431631305bd56244b3d”,”id”:”CVE-2026-35207″,”bulletinFamily”:””,”cwe”:[“CWE-295″],”cvelist”:null,”sourceData”:”linuxdeepin dde-control-center \\u003e= 6.1.35, \\u003c 6.1.80\\nlinuxdeepin dde-control-center \\u003e= 5.5.3, \\u003c 5.9.9\\nlinuxdeepin deepin-deepinid-plugin \\u003e= 2.0.1, \\u003c= 2.0.9″,”sourceHref”:””,”cvss”:{“score”:5.4,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:L\/I:L\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”dde-control-center”,”version”:”\\u003e= 6.1.35, \\u003c 6.1.80″,”vendor”:”linuxdeepin”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”dde-control-center is the control panel of DDE, the Deepin Desktop Environment. plugin-deepinid is a plugin in dde-control-center, which provides the deepinid cloud service. Prior to…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,82,12,21,13,7,11,5],"class_list":["post-42707","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-54","tag-exploit","tag-medium","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n