The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Details
- CVSS 3.1 Base Score: 3.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libpurpleUpgrade pidgin-develUpgrade libpurple-tclUpgrade finchUpgrade libpurple-develUpgrade pidginUpgrade finch-develUpgrade libpurple-perlUpgrade pidgin-perlUpgrade pidgin-debuginfo | Aug 28, 2019 | Oct 29, 2014 |
| Debian | — | Upgrade pidgin | Jul 30, 2024 | Oct 29, 2014 |
| Freebsd | — | Upgrade pidginUpgrade libpurple | Dec 10, 2025 | Oct 24, 2014 |
| Huawei Euleros 2_0_sp1 | — | Upgrade libpurple | Nov 30, 2017 | Oct 29, 2014 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libpurple | Nov 30, 2017 | Oct 29, 2014 |
| Oracle Solaris | — | Upgrade communication/im/pidgin to version 2.10.11-0.175.2.11.0.3.0 on Solaris 11.2Upgrade consolidation/desktop/desktop-incorporation to version 0.5.11-0.175.3.0.0.28.0 on Solaris 11.3 | May 29, 2017 | Oct 29, 2014 |
| Oracle_linux | — | Upgrade libpurple-tclUpgrade libpurple-develUpgrade pidginUpgrade libpurple-perlUpgrade finchUpgrade libpurpleUpgrade pidgin-perlUpgrade finch-develUpgrade pidgin-devel | Aug 8, 2017 | Oct 22, 2014 |
| Redhat_linux | — | Upgrade pidgin-develUpgrade libpurple-perlUpgrade pidgin-debuginfoUpgrade libpurple-develUpgrade libpurpleUpgrade finch-develNo solution existsUpgrade libpurple-tclUpgrade finchUpgrade pidginUpgrade pidgin-perl | Aug 3, 2017 | Oct 29, 2014 |
| Suse | — | Upgrade finch-develUpgrade libpurple-branding-upstreamUpgrade libpurple-langUpgrade pidgin-develUpgrade libpurple-meanwhileUpgrade libpurple-develUpgrade libpurple-plugin-sametimeUpgrade pidginUpgrade finchUpgrade libpurpleUpgrade libpurple-tcl | Dec 18, 2015 | Oct 29, 2014 |
| Ubuntu | — | Upgrade libpurple0Upgrade pidgin | Nov 8, 2024 | Oct 29, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub