Information Disclosure

2020-04-1000:36:05

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.004 Low

EPSS

Percentile

75.0%

JSON

pidgin is vulnerable to information disclosure. It was discovered that, when connecting to certain, very old Jabber servers via XMPP, Pidgin may ignore the “Require SSL/TLS” setting. In these situations, a non-encrypted connection is established rather than the connection failing, causing the user to believe they are using an encrypted connection when they are not, leading to sensitive information disclosure (session sniffing).

CPENameOperatorVersion
pidgineq2.5.8__1.el4
pidgineq2.3.1__2.el4
pidgineq2.5.5__3.el5
pidgineq1.5.1__1.el4
pidgineq2.5.9__1.el5
pidgineq2.5.5__1.el4
pidgineq2.0.2__3.el5
pidgineq2.3.1__1.el5
pidgineq2.5.5__2.el4
pidgineq2.5.5__1.el5

Name	Operator	Version
pidgin	eq	2.5.8__1.el4
pidgin	eq	2.3.1__2.el4
pidgin	eq	2.5.5__3.el5
pidgin	eq	1.5.1__1.el4
pidgin	eq	2.5.9__1.el5
pidgin	eq	2.5.5__1.el4
pidgin	eq	2.0.2__3.el5
pidgin	eq	2.3.1__1.el5
pidgin	eq	2.5.5__2.el4
pidgin	eq	2.5.5__1.el5