1. Forum
  2. Usenet
  3. LINUX.DEBIAN.ANNOUNCE.SEC

  • [SECURITY] [DSA 2702-1] telepathy-gabble security update

    From Salvatore Bonaccorso@1:229/2 to All on Mon Jun 3 20:50:02 2013
    From: [email protected]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA512

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-2702-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso
    June 03, 2013 http://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : telepathy-gabble
    Vulnerability : TLS verification bypass
    Problem type : remote
    Debian-specific: no
    CVE ID : CVE-2013-1431

    Maksim Otstavnov discovered that the Wocky submodule used by
    telepathy-gabble, the Jabber/XMPP connection manager for the Telepathy framework, does not respect the tls-required flag on legacy Jabber
    servers. A network intermediary could use this vulnerability to bypass
    TLS verification and perform a man-in-the-middle attack.

    For the oldstable distribution (squeeze), this problem has been fixed in version 0.9.15-1+squeeze2.

    For the stable distribution (wheezy), this problem has been fixed in
    version 0.16.5-1+deb7u1.

    For the testing distribution (jessie) and the unstable distribution
    (sid), this problem has been fixed in version 0.16.6-1.

    We recommend that you upgrade your telepathy-gabble packages.

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: http://www.debian.org/security/

    Mailing list: [email protected]
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.12 (GNU/Linux)

    iQIcBAEBCgAGBQJRrN7oAAoJEHidbwV/2GP+w7UQAPdyY+3efgaylM7RFwzpI46R zoGZBdjOBNwjKMIKRC2T77R8UOk5IAHCxTTW0SPI4gfbAktIP+w9TTMd5KnpIyH3 7ATwATgEVbtaNdLLLlGd5mBy3GbJ/FbshJcpk8K5vKMGMgQDrzLO87N+zW4XwTda JuaRl0s9n7enFADtDNZggYX/2KFNft2t4FVHJFjN3kX64oeTJ+E77oeD2J+pt5+T Dv+MlL2+cmE0jNzKIEvRQ8fudNCeHlfkfAT24vxlHUnj/JXxl9jxtGFiFDurvc7j 5d18QvvJAL2MtcTxMqbdeiYW3Xf2aVKg/E+a9DfEqM6DHEKwNy8+rezvAuB4Evlv 6PTA5y8+L0ML2jgYGdyVYT9QKcLmbrXRJEB12x7qF/nDEi2Hem+I5lhwe9pxGAZV TVO99XWUZ4ynS8NSMCnGOlwBy7hQlTP/DHlAlSRv9M+rcjyAPNXZXXKQXsA1e8f6 K7xYlhzde1mjBjWL+qaaNyaBYpNsczjFwHs3BZVeWHzXtIp8UkRs8/Q1GUbE9q80 OyFgFMIViY4Th1Gasvf6Whnkf0oysm1DdIyor1lvDphnTRYFl+KVumaTYyTtyq19 reOK8uK4+R+809xa7uX3a0bZbTbPD3IAKfyf1ohUnUW+RgAKelMgCw1E2msfa/XT uUo0CA7JK1ajStmkolxg
    =nfk7
    -----END PGP SIGNATURE-----


    --
    To UNSUBSCRIBE, email to [email protected]
    with a subject of "unsubscribe". Trouble? Contact [email protected] Archive: http://lists.debian.org/[email protected]

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)