NetSight
IP …
medium6.4

CVE-2014-3694

The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Const…

Impact

The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Affected products

VendorProductAffected versions
OpensuseOpensuse
Versions 12.3, 13.1, 13.2
CanonicalUbuntu Linux
Versions 12.04, 14.04, 14.10
DebianDebian Linux
Version 7.0
PidginPidgin
through 2.10.9
Versions 2.10.0, 2.10.1, 2.10.2, 2.10.3, 2.10.4

Weakness classification

CWE-310

References