Catalogo CVE

CVE-2022-26491

pidgin affected and fixed versions

[Catalogo CVE]

An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicious server. The client will perform TLS certificate verification of the malicious domain name instead of the original XMPP service domain, allowing the attacker to take over control over the XMPP connection and to obtain user credentials and all communication content. This is similar to CVE-2022-24968.

Gravità
High · CVSS 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.56% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixiepidgin2.14.14-1Fixed[CVE-2022-26491]
Debiantrixiepidgin2.14.9-1FixedDistribution-reported fixed boundary[CVE-2022-26491]
Debiansidpidgin2.14.14-1Fixed[CVE-2022-26491]
Debiansidpidgin2.14.9-1FixedDistribution-reported fixed boundary[CVE-2022-26491]
Debianforkypidgin2.14.14-1Fixed[CVE-2022-26491]
Debianforkypidgin2.14.9-1FixedDistribution-reported fixed boundary[CVE-2022-26491]
Debianbookwormpidgin2.14.12-1Fixed[CVE-2022-26491]
Debianbookwormpidgin2.14.9-1FixedDistribution-reported fixed boundary[CVE-2022-26491]

Showing 8 fix observations. All 16 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debianbookwormpidgin2.14.12-1Fixed[CVE-2022-26491]
Debianbookwormpidgin2.14.9-1FixedDistribution-reported fixed boundary[CVE-2022-26491]
Debianforkypidgin2.14.14-1Fixed[CVE-2022-26491]
Debianforkypidgin2.14.9-1FixedDistribution-reported fixed boundary[CVE-2022-26491]
Debiansidpidgin2.14.14-1Fixed[CVE-2022-26491]
Debiansidpidgin2.14.9-1FixedDistribution-reported fixed boundary[CVE-2022-26491]
Debiantrixiepidgin2.14.14-1Fixed[CVE-2022-26491]
Debiantrixiepidgin2.14.9-1FixedDistribution-reported fixed boundary[CVE-2022-26491]
Opensuseleap 15.3pidgin2.13.0-150200.12.6.1UnknownSource applicability is not established[SUSE-SU-2022:1665-1]
Opensuseleap 15.4pidgin2.13.0-150200.12.6.1UnknownSource applicability is not established[SUSE-SU-2022:1665-1]
Suselinux enterprise module for package hub 15 sp3pidgin2.13.0-150200.12.6.1UnknownSource applicability is not established[SUSE-SU-2022:1665-1]
Suselinux enterprise module for package hub 15 sp4pidgin2.14.8-150400.3.3.1UnknownSource applicability is not established[SUSE-SU-2022:1693-1]
Suselinux enterprise software development kit 12 sp5pidgin2.12.0-3.6.1UnknownSource applicability is not established[SUSE-SU-2022:1664-1]
Suselinux enterprise workstation extension 12 sp5pidgin2.12.0-3.6.1UnknownSource applicability is not established[SUSE-SU-2022:1664-1]
Suselinux enterprise workstation extension 15 sp3pidgin2.13.0-150200.12.6.1UnknownSource applicability is not established[SUSE-SU-2022:1665-1]
Suselinux enterprise workstation extension 15 sp4pidgin2.14.8-150400.3.3.1UnknownSource applicability is not established[SUSE-SU-2022:1693-1]
Original provider fields
{
  "package_releases": [
    {
      "name": "pidgin",
      "status": "fixed",
      "release": "sid",
      "version": "2.14.14-1"
    },
    {
      "name": "pidgin",
      "status": "fixed",
      "release": "forky",
      "version": "2.14.14-1"
    },
    {
      "name": "pidgin",
      "status": "fixed",
      "release": "trixie",
      "version": "2.14.14-1"
    },
    {
      "name": "pidgin",
      "status": "fixed",
      "release": "bookworm",
      "version": "2.14.12-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "pidgin",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "2.14.9-1"
    },
    {
      "bug": null,
      "name": "pidgin",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "2.14.9-1"
    },
    {
      "bug": null,
      "name": "pidgin",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "2.14.9-1"
    },
    {
      "bug": null,
      "name": "pidgin",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "2.14.9-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "pidgin",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.14.8-150400.3.3.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for package hub 15 sp4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1693-1",
      "fixed_version": "2.14.8-150400.3.3.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1693-1",
      "provider_updated_at": "2026-02-04T04:30:05.091595Z",
      "applicability_unknown": true
    },
    {
      "name": "pidgin",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.14.8-150400.3.3.1"
            }
          ]
        }
      ],
      "release": "linux enterprise workstation extension 15 sp4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1693-1",
      "fixed_version": "2.14.8-150400.3.3.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1693-1",
      "provider_updated_at": "2026-02-04T04:30:05.091595Z",
      "applicability_unknown": true
    },
    {
      "name": "pidgin",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.13.0-150200.12.6.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for package hub 15 sp3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1665-1",
      "fixed_version": "2.13.0-150200.12.6.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1665-1",
      "provider_updated_at": "2026-02-04T03:32:40.122101Z",
      "applicability_unknown": true
    },
    {
      "name": "pidgin",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.13.0-150200.12.6.1"
            }
          ]
        }
      ],
      "release": "linux enterprise workstation extension 15 sp3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1665-1",
      "fixed_version": "2.13.0-150200.12.6.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1665-1",
      "provider_updated_at": "2026-02-04T03:32:40.122101Z",
      "applicability_unknown": true
    },
    {
      "name": "pidgin",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.13.0-150200.12.6.1"
            }
          ]
        }
      ],
      "release": "leap 15.3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1665-1",
      "fixed_version": "2.13.0-150200.12.6.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1665-1",
      "provider_updated_at": "2026-02-04T03:32:40.122101Z",
      "applicability_unknown": true
    },
    {
      "name": "pidgin",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.13.0-150200.12.6.1"
            }
          ]
        }
      ],
      "release": "leap 15.4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1665-1",
      "fixed_version": "2.13.0-150200.12.6.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1665-1",
      "provider_updated_at": "2026-02-04T03:32:40.122101Z",
      "applicability_unknown": true
    },
    {
      "name": "pidgin",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.12.0-3.6.1"
            }
          ]
        }
      ],
      "release": "linux enterprise software development kit 12 sp5",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1664-1",
      "fixed_version": "2.12.0-3.6.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1664-1",
      "provider_updated_at": "2025-05-02T04:33:00.176491Z",
      "applicability_unknown": true
    },
    {
      "name": "pidgin",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.12.0-3.6.1"
            }
          ]
        }
      ],
      "release": "linux enterprise workstation extension 12 sp5",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1664-1",
      "fixed_version": "2.12.0-3.6.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1664-1",
      "provider_updated_at": "2025-05-02T04:33:00.176491Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

L’associazione dei pacchetti è in corso.

[Debian 12 (Bookworm)]

  • [finch]Sconosciuto

    Pacchetto sorgente: [pidgin]

    Dettagli (2)

    • 2.14.12-1 · amd64 · bookworm

      Corretta · Corretta: 2.14.9-1

      dsa · pidgin · debian · bookworm

    • 2.14.12-1 · arm64 · bookworm

      Corretta · Corretta: 2.14.9-1

      dsa · pidgin · debian · bookworm

  • [finch-dev]Sconosciuto

    Pacchetto sorgente: [pidgin]

    Dettagli (2)

    • 2.14.12-1 · amd64 · bookworm

      Corretta · Corretta: 2.14.9-1

      dsa · pidgin · debian · bookworm

    • 2.14.12-1 · arm64 · bookworm

      Corretta · Corretta: 2.14.9-1

      dsa · pidgin · debian · bookworm

  • [libpurple0]Sconosciuto

    Pacchetto sorgente: [pidgin]

    Dettagli (2)

    • 2.14.12-1 · amd64 · bookworm

      Corretta · Corretta: 2.14.9-1

      dsa · pidgin · debian · bookworm

    • 2.14.12-1 · arm64 · bookworm

      Corretta · Corretta: 2.14.9-1

      dsa · pidgin · debian · bookworm

  • [libpurple-bin]Sconosciuto

    Pacchetto sorgente: [pidgin]

    Dettagli (2)

    • 2.14.12-1 · all · bookworm

      Corretta · Corretta: 2.14.9-1

      dsa · pidgin · debian · bookworm

    • 2.14.12-1 · all · bookworm

      Corretta · Corretta: 2.14.9-1

      dsa · pidgin · debian · bookworm

  • [libpurple-dev]Sconosciuto

    Pacchetto sorgente: [pidgin]

    Dettagli (2)

    • 2.14.12-1 · amd64 · bookworm

      Corretta · Corretta: 2.14.9-1

      dsa · pidgin · debian · bookworm

    • 2.14.12-1 · arm64 · bookworm

      Corretta · Corretta: 2.14.9-1

      dsa · pidgin · debian · bookworm

  • [pidgin]Sconosciuto
    Dettagli (2)

    • 2.14.12-1 · amd64 · bookworm

      Corretta · Corretta: 2.14.9-1

      dsa · pidgin · debian · bookworm

    • 2.14.12-1 · arm64 · bookworm

      Corretta · Corretta: 2.14.9-1

      dsa · pidgin · debian · bookworm

  • [pidgin-data]Sconosciuto

    Pacchetto sorgente: [pidgin]

    Dettagli (2)

    • 2.14.12-1 · all · bookworm

      Corretta · Corretta: 2.14.9-1

      dsa · pidgin · debian · bookworm

    • 2.14.12-1 · all · bookworm

      Corretta · Corretta: 2.14.9-1

      dsa · pidgin · debian · bookworm

  • [pidgin-dev]Sconosciuto

    Pacchetto sorgente: [pidgin]

    Dettagli (2)

    • 2.14.12-1 · amd64 · bookworm

      Corretta · Corretta: 2.14.9-1

      dsa · pidgin · debian · bookworm

    • 2.14.12-1 · arm64 · bookworm

      Corretta · Corretta: 2.14.9-1

      dsa · pidgin · debian · bookworm

Osservato:

Riferimenti

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]