CVE-2014-3694 The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X...
MediumCVSS 6.4
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/pidgin(Debian:12) | < 2.10.10-1 | 2.10.10-1 |
| debian/pidgin(Debian:13) | < 2.10.10-1 | 2.10.10-1 |
| debian/pidgin(Debian:14) | < 2.10.10-1 | 2.10.10-1 |
| opensuse | = 12.3 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.10 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| pidgin | <= 2.10.9 | No fix listed |
| pidgin | = 2.10.0 | No fix listed |
| pidgin | = 2.10.1 | No fix listed |
| pidgin | = 2.10.2 | No fix listed |
| pidgin | = 2.10.3 | No fix listed |
| pidgin | = 2.10.4 | No fix listed |
| pidgin | = 2.10.5 | No fix listed |
| pidgin | = 2.10.6 | No fix listed |
| pidgin | = 2.10.7 | No fix listed |
| pidgin | = 2.10.8 | No fix listed |
References
- Debian Security Tracker CVE-2014-3694 vendor-advisory
- hg.pidgin.im issue-tracking
- openSUSE-SU-2014:1376 third-party-advisory vendor-advisory
- openSUSE-SU-2014:1397 third-party-advisory vendor-advisory
- pidgin.im patch vendor-advisory
- 60741 third-party-advisory
- 61968 third-party-advisory
- DSA-3055 third-party-advisory vendor-advisory
- USN-2390-1 third-party-advisory vendor-advisory
- RHSA-2017:1854 vendor-advisory