Read the docs
TI-2012-04643 Aliases CVE-2012-5524GHSA-g8h3-j4r4-m45r

The _ssl_verify_callback function in tls_nb.py in Gajim before 0.15.3 does not properly…

Priority LOW 22CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

The _ssl_verify_callback function in tls_nb.py in Gajim before 0.15.3 does not properly verify SSL certificates, which allows remote attackers to conduct man-in-the-middle (MITM) attacks and spoof servers via an arbitrary certificate from a trusted CA.

Why it matters now

EPSS 0.01148 67th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 45

CPEVersionsRoleVendor
cpe:2.3:a:gajim:gajim:*:*:*:*:*:*:*:*up to 0.15.2VulnerableGajim
cpe:2.3:a:gajim:gajim:0.1:*:*:*:*:*:*:*0.1VulnerableGajim
cpe:2.3:a:gajim:gajim:0.2:*:*:*:*:*:*:*0.2VulnerableGajim
cpe:2.3:a:gajim:gajim:0.2.1:*:*:*:*:*:*:*0.2.1VulnerableGajim
cpe:2.3:a:gajim:gajim:0.3:*:*:*:*:*:*:*0.3VulnerableGajim
cpe:2.3:a:gajim:gajim:0.4:*:*:*:*:*:*:*0.4VulnerableGajim
cpe:2.3:a:gajim:gajim:0.4.1:*:*:*:*:*:*:*0.4.1VulnerableGajim
cpe:2.3:a:gajim:gajim:0.5:*:*:*:*:*:*:*0.5VulnerableGajim
cpe:2.3:a:gajim:gajim:0.5.1:*:*:*:*:*:*:*0.5.1VulnerableGajim
cpe:2.3:a:gajim:gajim:0.6:*:*:*:*:*:*:*0.6VulnerableGajim
  • cpe:2.3:a:gajim:gajim:*:*:*:*:*:*:*:* Versions up to 0.15.2 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.1:*:*:*:*:*:*:* Versions 0.1 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.2:*:*:*:*:*:*:* Versions 0.2 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.2.1:*:*:*:*:*:*:* Versions 0.2.1 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.3:*:*:*:*:*:*:* Versions 0.3 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.4:*:*:*:*:*:*:* Versions 0.4 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.4.1:*:*:*:*:*:*:* Versions 0.4.1 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.5:*:*:*:*:*:*:* Versions 0.5 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.5.1:*:*:*:*:*:*:* Versions 0.5.1 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.6:*:*:*:*:*:*:* Versions 0.6 Vulnerable ·Gajim
Show 35 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:gajim:gajim:0.6.1:*:*:*:*:*:*:*0.6.1VulnerableGajim
cpe:2.3:a:gajim:gajim:0.7:*:*:*:*:*:*:*0.7VulnerableGajim
cpe:2.3:a:gajim:gajim:0.7.1:*:*:*:*:*:*:*0.7.1VulnerableGajim
cpe:2.3:a:gajim:gajim:0.8:*:*:*:*:*:*:*0.8VulnerableGajim
cpe:2.3:a:gajim:gajim:0.8.1:*:*:*:*:*:*:*0.8.1VulnerableGajim
cpe:2.3:a:gajim:gajim:0.8.2:*:*:*:*:*:*:*0.8.2VulnerableGajim
cpe:2.3:a:gajim:gajim:0.9:*:*:*:*:*:*:*0.9VulnerableGajim
cpe:2.3:a:gajim:gajim:0.9.1:*:*:*:*:*:*:*0.9.1VulnerableGajim
cpe:2.3:a:gajim:gajim:0.10:*:*:*:*:*:*:*0.10VulnerableGajim
cpe:2.3:a:gajim:gajim:0.10.1:*:*:*:*:*:*:*0.10.1VulnerableGajim
cpe:2.3:a:gajim:gajim:0.11:*:*:*:*:*:*:*0.11VulnerableGajim
cpe:2.3:a:gajim:gajim:0.11.1:*:*:*:*:*:*:*0.11.1VulnerableGajim
cpe:2.3:a:gajim:gajim:0.11.2:*:*:*:*:*:*:*0.11.2VulnerableGajim
cpe:2.3:a:gajim:gajim:0.11.3:*:*:*:*:*:*:*0.11.3VulnerableGajim
cpe:2.3:a:gajim:gajim:0.11.4:*:*:*:*:*:*:*0.11.4VulnerableGajim
cpe:2.3:a:gajim:gajim:0.12:*:*:*:*:*:*:*0.12VulnerableGajim
cpe:2.3:a:gajim:gajim:0.12.1:*:*:*:*:*:*:*0.12.1VulnerableGajim
cpe:2.3:a:gajim:gajim:0.12.2:*:*:*:*:*:*:*0.12.2VulnerableGajim
cpe:2.3:a:gajim:gajim:0.12.3:*:*:*:*:*:*:*0.12.3VulnerableGajim
cpe:2.3:a:gajim:gajim:0.12.4:*:*:*:*:*:*:*0.12.4VulnerableGajim
cpe:2.3:a:gajim:gajim:0.12.5:*:*:*:*:*:*:*0.12.5VulnerableGajim
cpe:2.3:a:gajim:gajim:0.12.5:alpha1:*:*:*:*:*:*0.12.5 alpha1VulnerableGajim
cpe:2.3:a:gajim:gajim:0.12.5:beta1:*:*:*:*:*:*0.12.5 beta1VulnerableGajim
cpe:2.3:a:gajim:gajim:0.13:*:*:*:*:*:*:*0.13VulnerableGajim
cpe:2.3:a:gajim:gajim:0.13.1:*:*:*:*:*:*:*0.13.1VulnerableGajim
cpe:2.3:a:gajim:gajim:0.13.2:*:*:*:*:*:*:*0.13.2VulnerableGajim
cpe:2.3:a:gajim:gajim:0.13.3:*:*:*:*:*:*:*0.13.3VulnerableGajim
cpe:2.3:a:gajim:gajim:0.13.4:*:*:*:*:*:*:*0.13.4VulnerableGajim
cpe:2.3:a:gajim:gajim:0.14:*:*:*:*:*:*:*0.14VulnerableGajim
cpe:2.3:a:gajim:gajim:0.14.1:*:*:*:*:*:*:*0.14.1VulnerableGajim
cpe:2.3:a:gajim:gajim:0.14.2:*:*:*:*:*:*:*0.14.2VulnerableGajim
cpe:2.3:a:gajim:gajim:0.14.3:*:*:*:*:*:*:*0.14.3VulnerableGajim
cpe:2.3:a:gajim:gajim:0.14.4:*:*:*:*:*:*:*0.14.4VulnerableGajim
cpe:2.3:a:gajim:gajim:0.15:*:*:*:*:*:*:*0.15VulnerableGajim
cpe:2.3:a:gajim:gajim:0.15.1:*:*:*:*:*:*:*0.15.1VulnerableGajim
  • cpe:2.3:a:gajim:gajim:0.6.1:*:*:*:*:*:*:* Versions 0.6.1 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.7:*:*:*:*:*:*:* Versions 0.7 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.7.1:*:*:*:*:*:*:* Versions 0.7.1 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.8:*:*:*:*:*:*:* Versions 0.8 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.8.1:*:*:*:*:*:*:* Versions 0.8.1 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.8.2:*:*:*:*:*:*:* Versions 0.8.2 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.9:*:*:*:*:*:*:* Versions 0.9 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.9.1:*:*:*:*:*:*:* Versions 0.9.1 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.10:*:*:*:*:*:*:* Versions 0.10 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.10.1:*:*:*:*:*:*:* Versions 0.10.1 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.11:*:*:*:*:*:*:* Versions 0.11 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.11.1:*:*:*:*:*:*:* Versions 0.11.1 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.11.2:*:*:*:*:*:*:* Versions 0.11.2 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.11.3:*:*:*:*:*:*:* Versions 0.11.3 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.11.4:*:*:*:*:*:*:* Versions 0.11.4 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.12:*:*:*:*:*:*:* Versions 0.12 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.12.1:*:*:*:*:*:*:* Versions 0.12.1 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.12.2:*:*:*:*:*:*:* Versions 0.12.2 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.12.3:*:*:*:*:*:*:* Versions 0.12.3 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.12.4:*:*:*:*:*:*:* Versions 0.12.4 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.12.5:*:*:*:*:*:*:* Versions 0.12.5 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.12.5:alpha1:*:*:*:*:*:* Versions 0.12.5 alpha1 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.12.5:beta1:*:*:*:*:*:* Versions 0.12.5 beta1 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.13:*:*:*:*:*:*:* Versions 0.13 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.13.1:*:*:*:*:*:*:* Versions 0.13.1 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.13.2:*:*:*:*:*:*:* Versions 0.13.2 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.13.3:*:*:*:*:*:*:* Versions 0.13.3 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.13.4:*:*:*:*:*:*:* Versions 0.13.4 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.14:*:*:*:*:*:*:* Versions 0.14 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.14.1:*:*:*:*:*:*:* Versions 0.14.1 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.14.2:*:*:*:*:*:*:* Versions 0.14.2 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.14.3:*:*:*:*:*:*:* Versions 0.14.3 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.14.4:*:*:*:*:*:*:* Versions 0.14.4 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.15:*:*:*:*:*:*:* Versions 0.15 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.15.1:*:*:*:*:*:*:* Versions 0.15.1 Vulnerable ·Gajim

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-5524
  2. 2026-10-03 Alias added: GHSA-g8h3-j4r4-m45r

References

Exploit 1

Advisory 1

Other 2

  • TI-2012-01859 SQL injection vulnerability in the get_last_conversation_lines function in… CVSS 2.0HIGH 7.5
  • TI-2021-17909 Gajim 1.2.x and 1.3.x before 1.3.3 allows remote attackers to cause a denial of service… CVSS 3.1HIGH 7.5
  • TI-2012-01858 The exec_command function in common/helpers.py in Gajim before 0.15 allows user-assisted… CVSS 2.0MEDIUM 6.8
  • TI-2022-18830 An issue was discovered in Gajim through 1.4.7. CVSS 3.1MEDIUM 5.3
  • TI-2015-07148 Gajim before 0.16.5 allows remote attackers to modify the roster and intercept messages… CVSS 3.0MEDIUM 5.4
  • TI-2016-08426 Gajim through 0.16.7 unconditionally implements the "XEP-0146: Remote Controlling… CVSS 3.0MEDIUM 4.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences