<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for pidgin</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2022:1664-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2022-05-16T08:01:28Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2022-05-16T08:01:28Z</InitialReleaseDate>
    <CurrentReleaseDate>2022-05-16T08:01:28Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for pidgin</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for pidgin fixes the following issues:

- CVE-2022-26491: Fixed MITM vulnerability when DNSSEC wasn't used (bsc#1199025).
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-2022-1664,SUSE-SLE-SDK-12-SP5-2022-1664,SUSE-SLE-WE-12-SP5-2022-1664</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20221664-1/</URL>
      <Description>Link for SUSE-SU-2022:1664-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2022-May/011026.html</URL>
      <Description>E-Mail link for SUSE-SU-2022:1664-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1199025</URL>
      <Description>SUSE Bug 1199025</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-26491/</URL>
      <Description>SUSE CVE CVE-2022-26491 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Software Development Kit 12 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5" CPE="cpe:/o:suse:sle-sdk:12:sp5">SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Workstation Extension 12 SP5">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Workstation Extension 12 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 12 SP5" CPE="cpe:/o:suse:sle-we:12:sp5">SUSE Linux Enterprise Workstation Extension 12 SP5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="finch-2.12.0-3.6.1">
      <FullProductName ProductID="finch-2.12.0-3.6.1">finch-2.12.0-3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="finch-devel-2.12.0-3.6.1">
      <FullProductName ProductID="finch-devel-2.12.0-3.6.1">finch-devel-2.12.0-3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libpurple-2.12.0-3.6.1">
      <FullProductName ProductID="libpurple-2.12.0-3.6.1">libpurple-2.12.0-3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libpurple-branding-upstream-2.12.0-3.6.1">
      <FullProductName ProductID="libpurple-branding-upstream-2.12.0-3.6.1">libpurple-branding-upstream-2.12.0-3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libpurple-devel-2.12.0-3.6.1">
      <FullProductName ProductID="libpurple-devel-2.12.0-3.6.1">libpurple-devel-2.12.0-3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libpurple-lang-2.12.0-3.6.1">
      <FullProductName ProductID="libpurple-lang-2.12.0-3.6.1">libpurple-lang-2.12.0-3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libpurple-plugin-sametime-2.12.0-3.6.1">
      <FullProductName ProductID="libpurple-plugin-sametime-2.12.0-3.6.1">libpurple-plugin-sametime-2.12.0-3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libpurple-tcl-2.12.0-3.6.1">
      <FullProductName ProductID="libpurple-tcl-2.12.0-3.6.1">libpurple-tcl-2.12.0-3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="pidgin-2.12.0-3.6.1">
      <FullProductName ProductID="pidgin-2.12.0-3.6.1">pidgin-2.12.0-3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="pidgin-devel-2.12.0-3.6.1">
      <FullProductName ProductID="pidgin-devel-2.12.0-3.6.1">pidgin-devel-2.12.0-3.6.1</FullProductName>
    </Branch>
    <Relationship ProductReference="finch-devel-2.12.0-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5:finch-devel-2.12.0-3.6.1">finch-devel-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="libpurple-2.12.0-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5:libpurple-2.12.0-3.6.1">libpurple-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="libpurple-devel-2.12.0-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5:libpurple-devel-2.12.0-3.6.1">libpurple-devel-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="libpurple-lang-2.12.0-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5:libpurple-lang-2.12.0-3.6.1">libpurple-lang-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="pidgin-devel-2.12.0-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5:pidgin-devel-2.12.0-3.6.1">pidgin-devel-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="finch-2.12.0-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Workstation Extension 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 12 SP5:finch-2.12.0-3.6.1">finch-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="libpurple-2.12.0-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Workstation Extension 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 12 SP5:libpurple-2.12.0-3.6.1">libpurple-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="libpurple-branding-upstream-2.12.0-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Workstation Extension 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 12 SP5:libpurple-branding-upstream-2.12.0-3.6.1">libpurple-branding-upstream-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="libpurple-lang-2.12.0-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Workstation Extension 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 12 SP5:libpurple-lang-2.12.0-3.6.1">libpurple-lang-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="libpurple-plugin-sametime-2.12.0-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Workstation Extension 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 12 SP5:libpurple-plugin-sametime-2.12.0-3.6.1">libpurple-plugin-sametime-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="libpurple-tcl-2.12.0-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Workstation Extension 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 12 SP5:libpurple-tcl-2.12.0-3.6.1">libpurple-tcl-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="pidgin-2.12.0-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Workstation Extension 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 12 SP5:pidgin-2.12.0-3.6.1">pidgin-2.12.0-3.6.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicious server. The client will perform TLS certificate verification of the malicious domain name instead of the original XMPP service domain, allowing the attacker to take over control over the XMPP connection and to obtain user credentials and all communication content. This is similar to CVE-2022-24968.</Note>
    </Notes>
    <CVE>CVE-2022-26491</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:finch-devel-2.12.0-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:libpurple-2.12.0-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:libpurple-devel-2.12.0-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:libpurple-lang-2.12.0-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:pidgin-devel-2.12.0-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Workstation Extension 12 SP5:finch-2.12.0-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Workstation Extension 12 SP5:libpurple-2.12.0-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Workstation Extension 12 SP5:libpurple-branding-upstream-2.12.0-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Workstation Extension 12 SP5:libpurple-lang-2.12.0-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Workstation Extension 12 SP5:libpurple-plugin-sametime-2.12.0-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Workstation Extension 12 SP5:libpurple-tcl-2.12.0-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Workstation Extension 12 SP5:pidgin-2.12.0-3.6.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.1</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20221664-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-26491.html</URL>
        <Description>CVE-2022-26491</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1199025</URL>
        <Description>SUSE Bug 1199025</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
