CVE-2022-26491

 

Published at: - 02-06-2022 04:15

Last modified: - 09-06-2022 09:01

Total changes: - 3

Description

An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicious server. The client will perform TLS certificate verification of the malicious domain name instead of the original XMPP service domain, allowing the attacker to take over control over the XMPP connection and to obtain user credentials and all communication content. This is similar to CVE-2022-24968.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

 

Verification logic

 

Reference

• https://github.com/xsf/xeps/pull/1158
• https://pidgin.im/about/security/advisories/cve-2022-26491/
• https://mail.jabber.org/pipermail/standards/2022-February/038759.html
• https://keep.imfreedom.org/pidgin/pidgin/rev/13cdb7956bdc
• https://developer.pidgin.im/wiki/FullChangeLog
• [debian-lts-announce] 20220606 [SECURITY] [DLA 3043-1] pidgin security update-Mailing List, Third Party Advisory

 

Keywords

NVD

 

CVE-2022-26491

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures