| Name | CVE-2022-39835 |
| Description | An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| gajim (PTS) | jessie, jessie (lts) | 0.16-1+deb8u2 | vulnerable |
| stretch | 0.16.6-1.1 | vulnerable |
| buster | 1.1.2-2 | vulnerable |
| bullseye | 1.3.1-1 | vulnerable |
| bookworm | 1.7.3-2 | fixed |
| sid, trixie | 1.9.5-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| gajim | source | jessie | (unfixed) | end-of-life | | |
| gajim | source | stretch | (unfixed) | end-of-life | | |
| gajim | source | (unstable) | 1.5.0-1 | | | |
Notes
[bullseye] - gajim <no-dsa> (Minor issue)
[buster] - gajim <no-dsa> (Minor issue, intrusive to backport)
https://dev.gajim.org/gajim/gajim/-/commit/af02c6bd53fad4e0065951597bd7ec801c002067 (1.5.0)