Kopete: CVE 2017-5593 (User Impersonation Vulnerability)

Pali Rohár <[email protected]> Sat, 11 Feb 2017 13:59:01 +0100

Newsgroups	gmane.comp.kde.devel.kopete,gmane.comp.kde.releases
Message-ID	<201702111359.01422@pali>

Hello!

I need to inform you that jabber protocol in Kopete is vulnerable to 
CVE-2017-5593 (User Impersonation Vulnerability) due to defect in 
underlying Psi xmpp library libiris -- which is part of Kopete source 
tree. Note that Kopete is vulnerable even it does not support XEP-0280: 
Message Carbons yet (because defect is in libiris).

All Kopete versions which are part of KDE 16.11.80 (and new) are 
affected.

Backported fix for libiris is now in Application/16.12 branch in commit 
https://commits.kde.org/kopete/6243764c4fd0985320d4a10b48051cc418d584ad

And so fix will be part of KDE 16.12.3 (Kopete 1.11.3).

More information at:
https://bugs.kde.org/show_bug.cgi?id=376348
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5593
http://seclists.org/oss-sec/2017/q1/373
https://github.com/psi-im/iris/pull/47/commits/02e976d4426a1319a7af7d26d7aba9d8c6077570

-- 
Pali Rohár
[email protected]

signature.asc (application/pgp-signature, 198 B)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEABECAAYFAlifCpUACgkQi/DJPQPkQ1KkTQCcCo29DtPRSS1vjJBi2clNnXGo
CqIAoJSCaUhnl7Kx5/G259QijrODeHXM
=yDzD
-----END PGP SIGNATURE-----