Security update for pidgin SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:1665-1 Final 1 1 2022-05-16T08:01:59Z current 2022-05-16T08:01:59Z 2022-05-16T08:01:59Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for pidgin This update for pidgin fixes the following issues: - CVE-2022-26491: Fixed MITM vulnerability when DNSSEC wasn't used (bsc#1199025). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-1665,SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-1665,SUSE-SLE-Product-WE-15-SP3-2022-1665,openSUSE-SLE-15.3-2022-1665,openSUSE-SLE-15.4-2022-1665 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20221665-1/ Link for SUSE-SU-2022:1665-1 https://lists.suse.com/pipermail/sle-security-updates/2022-May/011017.html E-Mail link for SUSE-SU-2022:1665-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1199025 SUSE Bug 1199025 https://www.suse.com/security/cve/CVE-2022-26491/ SUSE CVE CVE-2022-26491 page SUSE Linux Enterprise Module for Package Hub 15 SP3 SUSE Linux Enterprise Workstation Extension 15 SP3 openSUSE Leap 15.3 openSUSE Leap 15.4 finch-2.13.0-150200.12.6.1 finch-devel-2.13.0-150200.12.6.1 libpurple-2.13.0-150200.12.6.1 libpurple-branding-upstream-2.13.0-150200.12.6.1 libpurple-devel-2.13.0-150200.12.6.1 libpurple-lang-2.13.0-150200.12.6.1 libpurple-plugin-sametime-2.13.0-150200.12.6.1 libpurple-tcl-2.13.0-150200.12.6.1 pidgin-2.13.0-150200.12.6.1 pidgin-devel-2.13.0-150200.12.6.1 finch-2.13.0-150200.12.6.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP3 finch-devel-2.13.0-150200.12.6.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP3 libpurple-2.13.0-150200.12.6.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP3 libpurple-branding-upstream-2.13.0-150200.12.6.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP3 libpurple-devel-2.13.0-150200.12.6.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP3 libpurple-lang-2.13.0-150200.12.6.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP3 libpurple-plugin-sametime-2.13.0-150200.12.6.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP3 libpurple-tcl-2.13.0-150200.12.6.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP3 pidgin-2.13.0-150200.12.6.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP3 pidgin-devel-2.13.0-150200.12.6.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP3 libpurple-2.13.0-150200.12.6.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP3 libpurple-branding-upstream-2.13.0-150200.12.6.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP3 libpurple-devel-2.13.0-150200.12.6.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP3 libpurple-lang-2.13.0-150200.12.6.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP3 libpurple-plugin-sametime-2.13.0-150200.12.6.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP3 pidgin-2.13.0-150200.12.6.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP3 pidgin-devel-2.13.0-150200.12.6.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP3 finch-2.13.0-150200.12.6.1 as a component of openSUSE Leap 15.3 finch-devel-2.13.0-150200.12.6.1 as a component of openSUSE Leap 15.3 libpurple-2.13.0-150200.12.6.1 as a component of openSUSE Leap 15.3 libpurple-branding-upstream-2.13.0-150200.12.6.1 as a component of openSUSE Leap 15.3 libpurple-devel-2.13.0-150200.12.6.1 as a component of openSUSE Leap 15.3 libpurple-lang-2.13.0-150200.12.6.1 as a component of openSUSE Leap 15.3 libpurple-plugin-sametime-2.13.0-150200.12.6.1 as a component of openSUSE Leap 15.3 libpurple-tcl-2.13.0-150200.12.6.1 as a component of openSUSE Leap 15.3 pidgin-2.13.0-150200.12.6.1 as a component of openSUSE Leap 15.3 pidgin-devel-2.13.0-150200.12.6.1 as a component of openSUSE Leap 15.3 finch-2.13.0-150200.12.6.1 as a component of openSUSE Leap 15.4 finch-devel-2.13.0-150200.12.6.1 as a component of openSUSE Leap 15.4 libpurple-2.13.0-150200.12.6.1 as a component of openSUSE Leap 15.4 libpurple-branding-upstream-2.13.0-150200.12.6.1 as a component of openSUSE Leap 15.4 libpurple-devel-2.13.0-150200.12.6.1 as a component of openSUSE Leap 15.4 libpurple-lang-2.13.0-150200.12.6.1 as a component of openSUSE Leap 15.4 libpurple-plugin-sametime-2.13.0-150200.12.6.1 as a component of openSUSE Leap 15.4 libpurple-tcl-2.13.0-150200.12.6.1 as a component of openSUSE Leap 15.4 pidgin-2.13.0-150200.12.6.1 as a component of openSUSE Leap 15.4 pidgin-devel-2.13.0-150200.12.6.1 as a component of openSUSE Leap 15.4 An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicious server. The client will perform TLS certificate verification of the malicious domain name instead of the original XMPP service domain, allowing the attacker to take over control over the XMPP connection and to obtain user credentials and all communication content. This is similar to CVE-2022-24968. CVE-2022-26491 SUSE Linux Enterprise Module for Package Hub 15 SP3:finch-2.13.0-150200.12.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP3:finch-devel-2.13.0-150200.12.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP3:libpurple-2.13.0-150200.12.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP3:libpurple-branding-upstream-2.13.0-150200.12.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP3:libpurple-devel-2.13.0-150200.12.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP3:libpurple-lang-2.13.0-150200.12.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP3:libpurple-plugin-sametime-2.13.0-150200.12.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP3:libpurple-tcl-2.13.0-150200.12.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP3:pidgin-2.13.0-150200.12.6.1 SUSE Linux Enterprise Module for Package Hub 15 SP3:pidgin-devel-2.13.0-150200.12.6.1 SUSE Linux Enterprise Workstation Extension 15 SP3:libpurple-2.13.0-150200.12.6.1 SUSE Linux Enterprise Workstation Extension 15 SP3:libpurple-branding-upstream-2.13.0-150200.12.6.1 SUSE Linux Enterprise Workstation Extension 15 SP3:libpurple-devel-2.13.0-150200.12.6.1 SUSE Linux Enterprise Workstation Extension 15 SP3:libpurple-lang-2.13.0-150200.12.6.1 SUSE Linux Enterprise Workstation Extension 15 SP3:libpurple-plugin-sametime-2.13.0-150200.12.6.1 SUSE Linux Enterprise Workstation Extension 15 SP3:pidgin-2.13.0-150200.12.6.1 SUSE Linux Enterprise Workstation Extension 15 SP3:pidgin-devel-2.13.0-150200.12.6.1 openSUSE Leap 15.3:finch-2.13.0-150200.12.6.1 openSUSE Leap 15.3:finch-devel-2.13.0-150200.12.6.1 openSUSE Leap 15.3:libpurple-2.13.0-150200.12.6.1 openSUSE Leap 15.3:libpurple-branding-upstream-2.13.0-150200.12.6.1 openSUSE Leap 15.3:libpurple-devel-2.13.0-150200.12.6.1 openSUSE Leap 15.3:libpurple-lang-2.13.0-150200.12.6.1 openSUSE Leap 15.3:libpurple-plugin-sametime-2.13.0-150200.12.6.1 openSUSE Leap 15.3:libpurple-tcl-2.13.0-150200.12.6.1 openSUSE Leap 15.3:pidgin-2.13.0-150200.12.6.1 openSUSE Leap 15.3:pidgin-devel-2.13.0-150200.12.6.1 openSUSE Leap 15.4:finch-2.13.0-150200.12.6.1 openSUSE Leap 15.4:finch-devel-2.13.0-150200.12.6.1 openSUSE Leap 15.4:libpurple-2.13.0-150200.12.6.1 openSUSE Leap 15.4:libpurple-branding-upstream-2.13.0-150200.12.6.1 openSUSE Leap 15.4:libpurple-devel-2.13.0-150200.12.6.1 openSUSE Leap 15.4:libpurple-lang-2.13.0-150200.12.6.1 openSUSE Leap 15.4:libpurple-plugin-sametime-2.13.0-150200.12.6.1 openSUSE Leap 15.4:libpurple-tcl-2.13.0-150200.12.6.1 openSUSE Leap 15.4:pidgin-2.13.0-150200.12.6.1 openSUSE Leap 15.4:pidgin-devel-2.13.0-150200.12.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221665-1/ https://www.suse.com/security/cve/CVE-2022-26491.html CVE-2022-26491 https://bugzilla.suse.com/1199025 SUSE Bug 1199025