Vulnerability in Pidgin
CVE-2022-26491
An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicious server. The client will perform TLS certificate verification of the malicious domain name instead of the original XMPP service domain, allowing the attacker to take over control over the XMPP connection and to obtain user credentials and all communication content. This is similar to CVE-2022-24968.
Vulnerability class: Improper Certificate Validation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.025 (84.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 84th percentile — 84.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.025 · newest: 0.025 · change: +0.000
Affected products
- Pidgin
- Debian Linux — versions 9.0
Weakness classification (CWE)
References
- mail.jabber.org/pipermail/standards/2022-February/038759.html (Mailing List, Third Party Advisory)
- github.com/xsf/xeps/pull/1158 (Patch, Third Party Advisory)
- developer.pidgin.im/wiki/FullChangeLog (Release Notes, Vendor Advisory)
- pidgin.im/about/security/advisories/cve-2022-26491/ (Vendor Advisory)
- keep.imfreedom.org/pidgin/pidgin/rev/13cdb7956bdc (Patch, Third Party Advisory)
- lists.debian.org/debian-lts-announce/2022/06/msg00005.html (mailing-list, Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-26491?
- CVE-2022-26491 is a medium-severity vulnerability in Pidgin, classified under Improper Certificate Validation. CVSS score: 5.9/10. Published 2022-06-02.
- How severe is CVE-2022-26491?
- Medium severity. CVSS v3 base score is 5.9 out of 10.