Every CVE Search/ Get API key

CVE-2013-1431

The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a...

6.8 MediumFix available

The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a "legacy Jabber server," does not properly enforce the WockyConnector:tls-required flag, which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks.

Exploit likelihood

2.03%Up 0.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.8

The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a "legacy Jabber server," does not properly enforce the WockyConnector:tls-required flag, which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks.

Record
CVE-2013-1431
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a "legacy Jabber server," does not properly enforce the WockyConnector:tls-required flag, which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks.

Record
CVE-2013-1431
Updated
2026-11-02
EUVDEUVD-2013-1469 No score

The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a "legacy Jabber server," does not properly enforce the WockyConnector:tls-required flag, which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks.

Record
EUVD-2013-1469
Updated
2026-11-03
GitHub AdvisoriesGHSA-cq2g-8982-9994 No score

The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a...

The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a "legacy Jabber server," does not properly enforce the WockyConnector:tls-required flag, which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks.

Record
GHSA-cq2g-8982-9994
Weakness
CWE-20
Updated
2026-11-02
OSVMGASA-2013-0170 No score

Updated telepathy-gabble package fixes security vulnerability

Maksim Otstavnov discovered that the Wocky submodule used by telepathy-gabble does not respect the tls-required flag on legacy Jabber servers. A network intermediary could use this vulnerability to bypass TLS verification and perform a man-in-the-middle attack.

Record
MGASA-2013-0170
Updated
2026-11-02
OSVopenSUSE-SU-2024:10079-1 No score

telepathy-gabble-0.18.3-1.10 on GA media

These are all security issues fixed in the telepathy-gabble-0.18.3-1.10 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10079-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
telepathy-gabble
Debian:6.0
 before 0.9.15-1+squeeze2, plus listed versions
0.9.15-10.9.15-1+squeeze1
0.9.15-1+squeeze2
telepathy-gabble
Debian:7
 before 0.16.5-1+deb7u1, plus listed versions
0.16.5-1
0.16.5-1+deb7u1
telepathy-gabble
Mageia:2
 before 0.16.6-1.mga2
0.16.6-1.mga2
telepathy-gabble
Mageia:3
 before 0.17.4-1.mga3
0.17.4-1.mga3
telepathy-gabble
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 0.18.3-1.10
0.18.3-1.10

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-1431 is a medium vulnerability (CVSS 6.8) in Simon Mcvittie Telepathy Gabble, published June 3, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.03%, the 81st percentile. Fixed in telepathy-gabble 0.9.15-1+squeeze2.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open