VDB
GHSA-39qg-c7hm-9wwf
GHSA-39qg-c7hm-9wwf
PUBLISHED
Record from GitHub Advisory Database · Published May 2, 2022
protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions.
Timeline
- May 2, 2022 CVE Published
- Apr 9, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-39qg-c7hm-9wwf
vulnetix vdb fixes GHSA-39qg-c7hm-9wwfOr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-39qg-c7hm-9wwf/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11070 url
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5757 url
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542891 url
- http://developer.pidgin.im/viewmtn/revision/diff/312e056d702d29379ea61aea9d27765f127bc888/with/55897c4ce0787edc1e7721b7f4a9b5cbc8357279 url
- https://nvd.nist.gov/vuln/detail/CVE-2009-3026 advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53000 url
- http://developer.pidgin.im/ticket/8131 url
- http://secunia.com/advisories/37071 url
- http://www.openwall.com/lists/oss-security/2009/08/24/2 url
- http://www.securityfocus.com/bid/36368 url