CVEvulnerability

CVE-2013-1431

6.8 MEDIUM Published 2013-09-23 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2013-09-23
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-20

Description

The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a "legacy Jabber server," does not properly enforce the WockyConnector:tls-required flag, which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks.

Affected configurations

• simon mcvittie telepathy gabble (<= 0.16.5) • simon mcvittie telepathy gabble 0.16.0 • simon mcvittie telepathy gabble 0.16.1 • simon mcvittie telepathy gabble 0.16.2 • simon mcvittie telepathy gabble 0.16.3 • simon mcvittie telepathy gabble 0.16.4 • simon mcvittie telepathy gabble 0.17.0 • simon mcvittie telepathy gabble 0.17.1 • simon mcvittie telepathy gabble 0.17.2 • simon mcvittie telepathy gabble 0.17.3

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References