Vulnetix
Try Vulnetix Request Demo
CVE-2009-3026 PUBLISHED CVSS 5 MEDIUM

protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions.

EPSS 0.53% · 66.9th percentile

Risk Scores

CVSS v2.0
5
EPSS Score
0.53%
66.9th percentile

Affected Products

VendorProductVersions
pidginpidgin2.6.0
n/an/an/a

Timeline

References

Open in Interactive Console →