GLSA-201401-02 : Gajim: Information disclosure
Medium Nessus Plugin ID 71809
SynopsisThe remote Gentoo host is missing one or more security-related patches.
DescriptionThe remote host is affected by the vulnerability described in GLSA-201401-02 (Gajim: Information disclosure)
The _ssl_verify_callback() function in tls_nb.py does not properly validate SSL certificates, causing any certificate to be accepted as valid as long as the root CA is valid.
A remote attacker might employ a specially crafted certificate to conduct man-in-the-middle attacks on SSL connections and potentially disclose sensitive information.
There is no known workaround at this time.
SolutionAll Gajim users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=net-im/gajim-0.15.3-r1'