CVE-2022-26491 Security feature bypass in n/a
Remote attackers can bypass TLS verification via DNS spoofing to intercept XMPP communications and steal user credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-26491?
CVE-2022-26491 is a medium-severity vulnerability in Debian Debian Linux, published on 31 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicious server. The client will perform TLS certificate verification of the malicious domain name instead of the original XMPP service domain, allowing the attacker to take over control over the XMPP connection and to obtain user credentials and all communication content. This is similar to CVE-2022-24968.
Weakness: CWE-295
Which versions are affected by CVE-2022-26491?
It affects 2 products.
Linux distribution packages (8)
pidgin SUSE:Linux Enterprise Module for Package Hub 15 SP3 | All versions | 2.13.0-150200.12.6.1 |
pidgin SUSE:Linux Enterprise Module for Package Hub 15 SP4 | All versions | 2.14.8-150400.3.3.1 |
pidgin SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 2.12.0-3.6.1 |
pidgin SUSE:Linux Enterprise Workstation Extension 12 SP5 | All versions | 2.12.0-3.6.1 |
pidgin SUSE:Linux Enterprise Workstation Extension 15 SP3 | All versions | 2.13.0-150200.12.6.1 |
pidgin SUSE:Linux Enterprise Workstation Extension 15 SP4 | All versions | 2.14.8-150400.3.3.1 |
pidgin openSUSE:Leap 15.3 | All versions | 2.13.0-150200.12.6.1 |
pidgin openSUSE:Leap 15.4 | All versions | 2.13.0-150200.12.6.1 |
Products include Debian Debian Linux, Pidgin Pidgin.
How do I fix CVE-2022-26491?
Upgrade to a fixed version.
Is CVE-2022-26491 being exploited?
There is no known exploitation of CVE-2022-26491 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2022-26491, DLA-3043-1, GHSA-4hw8-r3fw-2q2x, MGASA-2022-0208, SUSE-SU-2022:1664-1, SUSE-SU-2022:1665-1 and 3 more.