An issue was discovered in Pidgin before 2.14.9. A remote...
Vulnerability Description
An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicious server. The client will perform TLS certificate verification of the malicious domain name instead of the original XMPP service domain, allowing the attacker to take over control over the XMPP connection and to obtain user credentials and all communication content. This is similar to CVE-2022-24968.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-26491
Credits & Attribution
No credits recorded in the NVD database.
References
- https://mail.jabber.org/pipermail/standards/2022-February/038759.html
- https://github.com/xsf/xeps/pull/1158
- https://developer.pidgin.im/wiki/FullChangeLog
- https://pidgin.im/about/security/advisories/cve-2022-26491/
- https://keep.imfreedom.org/pidgin/pidgin/rev/13cdb7956bdc
- https://lists.debian.org/debian-lts-announce/2022/06/msg00005.html
More from pidgin
View All →Affected Vendor
pidgin
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.