The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Details
- CVSS 3.1 Base Score: 3.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade finchUpgrade libpurpleUpgrade pidginUpgrade pidgin-develUpgrade libpurple-tclUpgrade libpurple-develUpgrade pidgin-perlUpgrade pidgin-debuginfoUpgrade libpurple-perlUpgrade finch-devel | Aug 28, 2019 | Oct 29, 2014 |
| Debian | — | Upgrade pidgin | Jul 30, 2024 | Oct 29, 2014 |
| Freebsd | — | Upgrade pidginUpgrade libpurple | Dec 10, 2025 | Oct 24, 2014 |
| Huawei Euleros 2_0_sp1 | — | Upgrade libpurple | Nov 30, 2017 | Oct 29, 2014 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libpurple | Nov 30, 2017 | Oct 29, 2014 |
| Oracle Solaris | — | Upgrade consolidation/desktop/desktop-incorporation to version 0.5.11-0.175.3.0.0.28.0 on Solaris 11.3Upgrade communication/im/pidgin to version 2.10.11-0.175.2.11.0.3.0 on Solaris 11.2 | May 29, 2017 | Oct 29, 2014 |
| Oracle_linux | — | Upgrade pidgin-perlUpgrade finchUpgrade pidgin-develUpgrade libpurpleUpgrade libpurple-perlUpgrade finch-develUpgrade libpurple-develUpgrade libpurple-tclUpgrade pidgin | Aug 8, 2017 | Oct 22, 2014 |
| Redhat_linux | — | Upgrade pidgin-develUpgrade libpurple-develUpgrade pidgin-debuginfoUpgrade libpurpleUpgrade libpurple-perlUpgrade pidginUpgrade libpurple-tclNo solution existsUpgrade pidgin-perlUpgrade finchUpgrade finch-devel | Aug 3, 2017 | Oct 29, 2014 |
| Suse | — | Upgrade libpurple-langUpgrade finch-develUpgrade libpurple-branding-upstreamUpgrade pidgin-develUpgrade libpurple-tclUpgrade libpurpleUpgrade finchUpgrade pidginUpgrade libpurple-develUpgrade libpurple-plugin-sametimeUpgrade libpurple-meanwhile | Dec 18, 2015 | Oct 29, 2014 |
| Ubuntu | — | Upgrade libpurple0Upgrade pidgin | Nov 8, 2024 | Oct 29, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub