CVE-2014-3694
29.10.2014, 10:55
The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Enginsight
| Vendor | Product | Version |
|---|---|---|
| opensuse | opensuse | 12.3 |
| opensuse | opensuse | 13.1 |
| opensuse | opensuse | 13.2 |
| canonical | ubuntu_linux | 12.04 |
| canonical | ubuntu_linux | 14.04 |
| canonical | ubuntu_linux | 14.10 |
| debian | debian_linux | 7.0 |
| pidgin | pidgin | 𝑥 ≤ 2.10.9 |
| pidgin | pidgin | 2.10.0 |
| pidgin | pidgin | 2.10.1 |
| pidgin | pidgin | 2.10.2 |
| pidgin | pidgin | 2.10.3 |
| pidgin | pidgin | 2.10.4 |
| pidgin | pidgin | 2.10.5 |
| pidgin | pidgin | 2.10.6 |
| pidgin | pidgin | 2.10.7 |
| pidgin | pidgin | 2.10.8 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
References