CVE-2012-5524

NameCVE-2012-5524
DescriptionThe _ssl_verify_callback function in tls_nb.py in Gajim before 0.15.3 does not properly verify SSL certificates, which allows remote attackers to conduct man-in-the-middle (MITM) attacks and spoof servers via an arbitrary certificate from a trusted CA.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs693282

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gajim (PTS)buster1.1.2-2fixed
bullseye1.3.1-1fixed
bookworm1.7.3-2fixed
sid, trixie1.8.4-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gajimsourcewheezy0.15.1-4.1
gajimsource(unstable)0.15.4-1low693282

Notes

[squeeze] - gajim <no-dsa> (Minor issue)

Search for package or bug name: Reporting problems