Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2022:1693-1

Опубликовано: 17 мая 2022
Источник: suse-cvrf

Описание

Security update for pidgin

This update for pidgin fixes the following issues:

  • CVE-2022-26491: Fixed MITM vulnerability when DNSSEC wasn't used (bsc#1199025).

Список пакетов

SUSE Linux Enterprise Module for Package Hub 15 SP4
finch-2.14.8-150400.3.3.1
finch-devel-2.14.8-150400.3.3.1
libpurple-2.14.8-150400.3.3.1
libpurple-branding-upstream-2.14.8-150400.3.3.1
libpurple-devel-2.14.8-150400.3.3.1
libpurple-lang-2.14.8-150400.3.3.1
libpurple-plugin-sametime-2.14.8-150400.3.3.1
libpurple-tcl-2.14.8-150400.3.3.1
pidgin-2.14.8-150400.3.3.1
pidgin-devel-2.14.8-150400.3.3.1
SUSE Linux Enterprise Workstation Extension 15 SP4
libpurple-2.14.8-150400.3.3.1
libpurple-branding-upstream-2.14.8-150400.3.3.1
libpurple-client0-2.14.8-150400.3.3.1
libpurple-devel-2.14.8-150400.3.3.1
libpurple-lang-2.14.8-150400.3.3.1
libpurple-plugin-sametime-2.14.8-150400.3.3.1
libpurple0-2.14.8-150400.3.3.1
pidgin-2.14.8-150400.3.3.1
pidgin-devel-2.14.8-150400.3.3.1

Ссылки

Описание

An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicious server. The client will perform TLS certificate verification of the malicious domain name instead of the original XMPP service domain, allowing the attacker to take over control over the XMPP connection and to obtain user credentials and all communication content. This is similar to CVE-2022-24968.

Затронутые продукты
SUSE Linux Enterprise Module for Package Hub 15 SP4:finch-2.14.8-150400.3.3.1
SUSE Linux Enterprise Module for Package Hub 15 SP4:finch-devel-2.14.8-150400.3.3.1
SUSE Linux Enterprise Module for Package Hub 15 SP4:libpurple-2.14.8-150400.3.3.1
SUSE Linux Enterprise Module for Package Hub 15 SP4:libpurple-branding-upstream-2.14.8-150400.3.3.1
Ссылки