Debian has issued an advisory on June 3: http://www.debian.org/security/2013/dsa-2702 This is fixed upstream in 0.17.4 and 0.16.6: http://lists.freedesktop.org/archives/telepathy/2013-May/006450.html http://lists.freedesktop.org/archives/telepathy/2013-May/006449.html Updated packages uploaded for Mageia 2, Mageia 3, and Cauldron. I don't know if you'll be able to find any "legacy Jabber" servers to test this against. They were pretty easy to set up yourself (I used to run one), but we haven't had that software packaged since Mandrake years ago (and probably Mandriva as well). Advisory: ======================== Updated telepathy-gabble package fixes security vulnerability: Maksim Otstavnov discovered that the Wocky submodule used by telepathy-gabble does not respect the tls-required flag on legacy Jabber servers. A network intermediary could use this vulnerability to bypass TLS verification and perform a man-in-the-middle attack. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1431 http://www.debian.org/security/2013/dsa-2702 http://lists.freedesktop.org/archives/telepathy/2013-May/006450.html http://lists.freedesktop.org/archives/telepathy/2013-May/006449.html ======================== Updated packages in core/updates_testing: ======================== telepathy-gabble-0.16.6-1.mga2 telepathy-gabble-0.17.4-1.mga3 from SRPMS: telepathy-gabble-0.16.6-1.mga2.src.rpm telepathy-gabble-0.17.4-1.mga3.src.rpm Reproducible: Steps to Reproduce:
Whiteboard: (none) => MGA2TOO
For testing just connecting to jabber with empathy using gmail credentials Testing complete mga3 32 & 64
Whiteboard: MGA2TOO => MGA2TOO has_procedure mga3-64-ok mga3-32-ok
Testing complete mga2 32 & 64 Validating Advisory & srpms in comment 0 Could sysadmin please push from 2 & 3 core/updates_testing to core/updates Thanks!
Keywords: (none) => validated_updateWhiteboard: MGA2TOO has_procedure mga3-64-ok mga3-32-ok => MGA2TOO has_procedure mga3-64-ok mga3-32-ok mga2-64-ok mga2-32-okCC: (none) => sysadmin-bugs
http://advisories.mageia.org/MGASA-2013-0170.html
Status: NEW => RESOLVEDCC: (none) => boklmResolution: (none) => FIXED
CC: boklm => (none)