CVE catalog
CVE-2013-1431
telepathy-gabble - TLS verification bypass
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 2.03% · Oct 25, 2026
The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a "legacy Jabber server," does not properly enforce the WockyConnector:tls-required flag, which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | telepathy-gabble | 6.0 | 0.9.15-1 | vulnerable |
| Debian | telepathy-gabble | 6.0 | 0.9.15-1+squeeze1 | vulnerable |
| Debian | telepathy-gabble | 6.0 | 0.9.15-1+squeeze2 | fixed |
| Debian | telepathy-gabble | 7 | 0.16.5-1 | vulnerable |
| Debian | telepathy-gabble | 7 | 0.16.5-1+deb7u1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | telepathy-gabble | deb | 6.0 | 0.9.15-1+squeeze2 | Not reported | DSA-2702-1 | Not reported |
| Debian | telepathy-gabble | deb | 7 | 0.16.5-1+deb7u1 | Not reported | DSA-2702-1 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed: