Every CVESearch/Get API key

CVE-2013-1431

The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a...

6.8 MediumFix available

The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a "legacy Jabber server," does not properly enforce the WockyConnector:tls-required flag, which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks.

Exploit likelihood

2.03%Up 0.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used6.8

The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a "legacy Jabber server," does not properly enforce the WockyConnector:tls-required flag, which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks.

Record
CVE-2013-1431
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE ListNo score

The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a "legacy Jabber server," does not properly enforce the WockyConnector:tls-required flag, which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks.

Record
CVE-2013-1431
Updated
2026-11-02
EUVDEUVD-2013-1469No score

The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a "legacy Jabber server," does not properly enforce the WockyConnector:tls-required flag, which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks.

Record
EUVD-2013-1469
Updated
2026-11-03
GitHub AdvisoriesGHSA-cq2g-8982-9994No score

The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a...

The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a "legacy Jabber server," does not properly enforce the WockyConnector:tls-required flag, which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks.

Record
GHSA-cq2g-8982-9994
Weakness
CWE-20
Updated
2026-11-02
OSVMGASA-2013-0170No score

Updated telepathy-gabble package fixes security vulnerability

Maksim Otstavnov discovered that the Wocky submodule used by telepathy-gabble does not respect the tls-required flag on legacy Jabber servers. A network intermediary could use this vulnerability to bypass TLS verification and perform a man-in-the-middle attack.

Record
MGASA-2013-0170
Updated
2026-11-02
OSVopenSUSE-SU-2024:10079-1No score

telepathy-gabble-0.18.3-1.10 on GA media

These are all security issues fixed in the telepathy-gabble-0.18.3-1.10 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10079-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
telepathy-gabble
Debian:6.0
before 0.9.15-1+squeeze2, plus listed versions
0.9.15-10.9.15-1+squeeze1
0.9.15-1+squeeze2
telepathy-gabble
Debian:7
before 0.16.5-1+deb7u1, plus listed versions
0.16.5-1
0.16.5-1+deb7u1
telepathy-gabble
Mageia:2
before 0.16.6-1.mga2
0.16.6-1.mga2
telepathy-gabble
Mageia:3
before 0.17.4-1.mga3
0.17.4-1.mga3
telepathy-gabble
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
before 0.18.3-1.10
0.18.3-1.10

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-1431 is a medium vulnerability (CVSS 6.8) in Simon Mcvittie Telepathy Gabble, published June 3, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.03%, the 81st percentile. Fixed in telepathy-gabble 0.9.15-1+squeeze2.

References

Show 7 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open