4.3

CVE-2012-5524

Exploit
The _ssl_verify_callback function in tls_nb.py in Gajim before 0.15.3 does not properly verify SSL certificates, which allows remote attackers to conduct man-in-the-middle (MITM) attacks and spoof servers via an arbitrary certificate from a trusted CA.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gajim ≫ Gajim Version <= 0.15.2
Gajim ≫ Gajim Version 0.1
Gajim ≫ Gajim Version 0.2
Gajim ≫ Gajim Version 0.2.1
Gajim ≫ Gajim Version 0.3
Gajim ≫ Gajim Version 0.4
Gajim ≫ Gajim Version 0.4.1
Gajim ≫ Gajim Version 0.5
Gajim ≫ Gajim Version 0.5.1
Gajim ≫ Gajim Version 0.6
Gajim ≫ Gajim Version 0.6.1
Gajim ≫ Gajim Version 0.7
Gajim ≫ Gajim Version 0.7.1
Gajim ≫ Gajim Version 0.8
Gajim ≫ Gajim Version 0.8.1
Gajim ≫ Gajim Version 0.8.2
Gajim ≫ Gajim Version 0.9
Gajim ≫ Gajim Version 0.9.1
Gajim ≫ Gajim Version 0.10
Gajim ≫ Gajim Version 0.10.1
Gajim ≫ Gajim Version 0.11
Gajim ≫ Gajim Version 0.11.1
Gajim ≫ Gajim Version 0.11.2
Gajim ≫ Gajim Version 0.11.3
Gajim ≫ Gajim Version 0.11.4
Gajim ≫ Gajim Version 0.12
Gajim ≫ Gajim Version 0.12.1
Gajim ≫ Gajim Version 0.12.2
Gajim ≫ Gajim Version 0.12.3
Gajim ≫ Gajim Version 0.12.4
Gajim ≫ Gajim Version 0.12.5
Gajim ≫ Gajim Version 0.12.5 Update alpha1
Gajim ≫ Gajim Version 0.12.5 Update beta1
Gajim ≫ Gajim Version 0.13
Gajim ≫ Gajim Version 0.13.1
Gajim ≫ Gajim Version 0.13.2
Gajim ≫ Gajim Version 0.13.3
Gajim ≫ Gajim Version 0.13.4
Gajim ≫ Gajim Version 0.14
Gajim ≫ Gajim Version 0.14.1
Gajim ≫ Gajim Version 0.14.2
Gajim ≫ Gajim Version 0.14.3
Gajim ≫ Gajim Version 0.14.4
Gajim ≫ Gajim Version 0.15
Gajim ≫ Gajim Version 0.15.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.15% 0.626
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://security.gentoo.org/glsa/glsa-201401-02.xml
http://www.openwall.com/lists/oss-security/2012/11/11/6
https://trac.gajim.org/query?status=closed&group=resolution&milestone=0.15.3
https://trac.gajim.org/ticket/7252
Patch
Exploit