PT-2013-1087 · Free Software Foundation · Telepathy Gabble

Published 2013-06-18 · Updated 2024-06-15 · CVE-2013-1431

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Telepathy Gabble versions prior to 0.16.6 Telepathy Gabble versions 0.17.x prior to 0.17.4

Description The issue allows remote attackers to bypass TLS verification, potentially leading to man-in-the-middle attacks when connecting to a "legacy Jabber server". This could compromise the confidentiality, integrity, and availability of protected information. The exploitation of this issue can be done remotely.

Recommendations For Telepathy Gabble versions prior to 0.16.6, update to version 0.16.6 or later. For Telepathy Gabble versions 0.17.x prior to 0.17.4, update to version 0.17.4 or later. As a temporary workaround, consider restricting access to the Wocky module until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-02882

CVE-2013-1431

DSA-2702-1

MGASA-2013-0170

OPENSUSE-SU-2024:10079-1

Affected Products

Telepathy Gabble

References · 17

• https://bdu.fstec.ru/vul/2015-02882 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-1431 · Security Note
• http://debian.org/security/2013/dsa-2702 · Vendor Advisory
• http://ubuntu.com/usn/USN-1873-1 · Vendor Advisory
• https://bugs.freedesktop.org/show_bug.cgi?id=65036 · Patch
• http://seclists.org/oss-sec/2013/q2/438 · Patch
• https://advisories.mageia.org/MGASA-2013-0170.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1431 · Security Note
• https://osv.dev/vulnerability/MGASA-2013-0170 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10079-1 · Vendor Advisory
• http://lists.freedesktop.org/archives/telepathy/2013-May/006450.html · Note
• http://secunia.com/advisories/53779 · Note
• http://lists.freedesktop.org/archives/telepathy/2013-May/006449.html · Note
• https://suse.com/security/cve/CVE-2013-1431 · Note
• https://bugs.mageia.org/show_bug.cgi?id=10432 · Note