CVE-2022-39835

NameCVE-2022-39835
DescriptionAn issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gajim (PTS)buster1.1.2-2vulnerable
bullseye1.3.1-1vulnerable
bookworm, sid1.6.1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gajimsource(unstable)1.5.0-1

Notes

[bullseye] - gajim <no-dsa> (Minor issue)
[buster] - gajim <no-dsa> (Minor issue, intrusive to backport)
https://dev.gajim.org/gajim/gajim/-/commit/af02c6bd53fad4e0065951597bd7ec801c002067 (1.5.0)

Search for package or bug name: Reporting problems