Pidgin Security Advisory
| Title | XMPP may not enforce TLS |
|---|
| Date | 2009-09-03 |
|---|
| CVE Name | CVE-2009-3026 |
|---|
| Discovered By | bugdave in ticket #8131 and Paul Aurich |
|---|
| Summary | XMPP does not always respect the "require TLS/SSL" preference |
|---|
| Description | The XMPP protocol plugin can be tricked into establishing an insecure connection by a malicious man in the middle by causing libpurple to use the older IQ-based login and then not offering TLS/SSL. The "require TLS/SSL" option was introduced in 2.2.0. |
|---|
| Fixed in Revision | 447ef31d038a |
|---|
| Fixed in Version | 2.6.0 |
|---|
| Fix | Respect the "require TLS/SSL" preference for this type of connection. |
|---|
Return to Security Advisory Index
