Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2022:1664-1

Опубликовано: 16 мая 2022
Источник: suse-cvrf

Описание

Security update for pidgin

This update for pidgin fixes the following issues:

  • CVE-2022-26491: Fixed MITM vulnerability when DNSSEC wasn't used (bsc#1199025).

Список пакетов

SUSE Linux Enterprise Software Development Kit 12 SP5
finch-devel-2.12.0-3.6.1
libpurple-2.12.0-3.6.1
libpurple-devel-2.12.0-3.6.1
libpurple-lang-2.12.0-3.6.1
pidgin-devel-2.12.0-3.6.1
SUSE Linux Enterprise Workstation Extension 12 SP5
finch-2.12.0-3.6.1
libpurple-2.12.0-3.6.1
libpurple-branding-upstream-2.12.0-3.6.1
libpurple-lang-2.12.0-3.6.1
libpurple-plugin-sametime-2.12.0-3.6.1
libpurple-tcl-2.12.0-3.6.1
pidgin-2.12.0-3.6.1

Ссылки

Описание

An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicious server. The client will perform TLS certificate verification of the malicious domain name instead of the original XMPP service domain, allowing the attacker to take over control over the XMPP connection and to obtain user credentials and all communication content. This is similar to CVE-2022-24968.

Затронутые продукты
SUSE Linux Enterprise Software Development Kit 12 SP5:finch-devel-2.12.0-3.6.1
SUSE Linux Enterprise Software Development Kit 12 SP5:libpurple-2.12.0-3.6.1
SUSE Linux Enterprise Software Development Kit 12 SP5:libpurple-devel-2.12.0-3.6.1
SUSE Linux Enterprise Software Development Kit 12 SP5:libpurple-lang-2.12.0-3.6.1
Ссылки