Security update for pidgin SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:1664-1 Final 1 1 2022-05-16T08:01:28Z current 2022-05-16T08:01:28Z 2022-05-16T08:01:28Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for pidgin This update for pidgin fixes the following issues: - CVE-2022-26491: Fixed MITM vulnerability when DNSSEC wasn't used (bsc#1199025). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-1664,SUSE-SLE-SDK-12-SP5-2022-1664,SUSE-SLE-WE-12-SP5-2022-1664 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20221664-1/ Link for SUSE-SU-2022:1664-1 https://lists.suse.com/pipermail/sle-security-updates/2022-May/011026.html E-Mail link for SUSE-SU-2022:1664-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1199025 SUSE Bug 1199025 https://www.suse.com/security/cve/CVE-2022-26491/ SUSE CVE CVE-2022-26491 page SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Workstation Extension 12 SP5 finch-2.12.0-3.6.1 finch-devel-2.12.0-3.6.1 libpurple-2.12.0-3.6.1 libpurple-branding-upstream-2.12.0-3.6.1 libpurple-devel-2.12.0-3.6.1 libpurple-lang-2.12.0-3.6.1 libpurple-plugin-sametime-2.12.0-3.6.1 libpurple-tcl-2.12.0-3.6.1 pidgin-2.12.0-3.6.1 pidgin-devel-2.12.0-3.6.1 finch-devel-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libpurple-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libpurple-devel-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libpurple-lang-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 pidgin-devel-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 finch-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 libpurple-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 libpurple-branding-upstream-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 libpurple-lang-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 libpurple-plugin-sametime-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 libpurple-tcl-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 pidgin-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicious server. The client will perform TLS certificate verification of the malicious domain name instead of the original XMPP service domain, allowing the attacker to take over control over the XMPP connection and to obtain user credentials and all communication content. This is similar to CVE-2022-24968. CVE-2022-26491 SUSE Linux Enterprise Software Development Kit 12 SP5:finch-devel-2.12.0-3.6.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpurple-2.12.0-3.6.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpurple-devel-2.12.0-3.6.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpurple-lang-2.12.0-3.6.1 SUSE Linux Enterprise Software Development Kit 12 SP5:pidgin-devel-2.12.0-3.6.1 SUSE Linux Enterprise Workstation Extension 12 SP5:finch-2.12.0-3.6.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libpurple-2.12.0-3.6.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libpurple-branding-upstream-2.12.0-3.6.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libpurple-lang-2.12.0-3.6.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libpurple-plugin-sametime-2.12.0-3.6.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libpurple-tcl-2.12.0-3.6.1 SUSE Linux Enterprise Workstation Extension 12 SP5:pidgin-2.12.0-3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221664-1/ https://www.suse.com/security/cve/CVE-2022-26491.html CVE-2022-26491 https://bugzilla.suse.com/1199025 SUSE Bug 1199025