Bug 620146 – <net-im/gajim-0.16.6-r1: XEP-0146 makes it possible to extract plain-text from OTR sessions (CVE-2016-10376)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2017-05-29 15:00:14 UTC]

From ${URL} :

Gajim unconditionally implements the "XEP-0146: Remote Controlling Clients" extension. This can be abused by malicious XMPP servers to, for example, extract plaintext from OTR encrypted sessions.

Upstream issue:

https://dev.gajim.org/gajim/gajim/issues/8378

Upstream patch:

https://dev.gajim.org/gajim/gajim/commit/cb65cfc5aed9efe05208ebbb7fb2d41fcf7253cc

References:

https://mail.jabber.org/pipermail/standards/2016-August/031335.html


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

[Comment 1 Amadeusz Żołnowski (RETIRED) 2017-05-29 16:58:29 UTC]

gajim-0.16.6-r1 with the fix is in the tree.

[Comment 2 Agostino Sarubbo 2017-06-01 07:41:50 UTC]

amd64 stable

[Comment 3 Agostino Sarubbo 2017-06-01 09:14:39 UTC]

x86 stable

[Comment 4 Markus Meier 2017-06-12 18:53:18 UTC]

arm stable

[Comment 5 Agostino Sarubbo 2017-06-13 12:33:40 UTC]

ppc64 stable

[Comment 6 Agostino Sarubbo 2017-06-21 12:01:16 UTC]

ppc stable.

Maintainer(s), please cleanup.
Security, please vote.

[Comment 7 Yury German 2017-07-04 21:22:39 UTC]

Arches, Thank you for your work.
New GLSA Request filed.

Maintainer(s), please drop the vulnerable version(s).

[Comment 8 Amadeusz Żołnowski (RETIRED) 2017-07-05 19:25:57 UTC]

Dropped 0.16.6.

[Comment 9 GLSAMaker/CVETool Bot 2017-07-10 00:06:53 UTC]

This issue was resolved and addressed in
 GLSA 201707-14 at https://security.gentoo.org/glsa/201707-14
by GLSA coordinator Thomas Deutschmann (whissi).