CVE-2014-3694
pidgin - security update
EPSS 2.3%
描述
The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
如何修補 CVE-2014-3694
要修補 CVE-2014-3694,請將受影響套件升級到下列已修補版本。
- Debian/pidgin—升級至 2.10.10-1 或更新版本
- Debian/pidgin—升級至 2.10.10-1~deb7u1 或更新版本
CVE-2014-3694 正在被利用嗎?
低 — EPSS 為 2.3%,目前沒有觀察到大規模利用活動。
受影響套件(2)
- from 0, < 2.10.10-1
- from 0, < 2.10.10-1~deb7u1