Gajim: Information disclosure

Gajim: Information disclosure An error in Gajim causes invalid OpenSSL certificates to be accepted as valid. gajim 2014-01-06 2014-01-06: 1 442860 remote 0.15.3-r1 0.15.3-r1

Gajim is a Jabber/XMPP client which uses GTK+.

The _ssl_verify_callback() function in tls_nb.py does not properly validate SSL certificates, causing any certificate to be accepted as valid as long as the root CA is valid.

A remote attacker might employ a specially crafted certificate to conduct man-in-the-middle attacks on SSL connections and potentially disclose sensitive information.

There is no known workaround at this time.

All Gajim users should upgrade to the latest version:


      # emerge --sync
      # emerge --ask --oneshot --verbose ">=net-im/gajim-0.15.3-r1"

CVE-2012-5524 creffett creffett