The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a "legacy Jabber server," does not properly enforce the WockyConnector:tls-required flag, which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks.
CVSS 2.0
Severity: MEDIUM
Problem Type: CWE-20,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| simon_mcvittie | telepathy_gabble | 0.17.0 |
| simon_mcvittie | telepathy_gabble | 0.16.0 |
| simon_mcvittie | telepathy_gabble | 0.16.3 |
| simon_mcvittie | telepathy_gabble | 0.16.1 |
| simon_mcvittie | telepathy_gabble | 0.17.2 |
| simon_mcvittie | telepathy_gabble | 0.17.3 |
| simon_mcvittie | telepathy_gabble | 0.16.2 |
| simon_mcvittie | telepathy_gabble | 0.16.4 |
| simon_mcvittie | telepathy_gabble | * |
| simon_mcvittie | telepathy_gabble | 0.17.1 |
A certain hashing algorithm in Telepathy Gabble 0.16.x before 0.16.5 and 0.17.x before 0.17.3 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted message.
CVSS 2.0
Severity: MEDIUM
Problem Type: CWE-310,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| simon_mcvittie | telepathy_gabble | 0.17.0 |
| simon_mcvittie | telepathy_gabble | 0.16.0 |
| simon_mcvittie | telepathy_gabble | 0.16.3 |
| simon_mcvittie | telepathy_gabble | 0.16.1 |
| simon_mcvittie | telepathy_gabble | 0.17.2 |
| simon_mcvittie | telepathy_gabble | 0.16.2 |
| simon_mcvittie | telepathy_gabble | 0.16.4 |
| simon_mcvittie | telepathy_gabble | 0.17.1 |