CVE:CVE-2012-5524
CNNVD:CNNVD-201211-207
Gajim是Gajim项目开发的一套基于Jabber通讯协定的自由即时通讯软件。该软件采用GTK+套件编写而成，支持分页聊天窗口、小组讨论、表情图案等。
Gajim 0.15.3之前的版本中的tls_nb.py文件中的‘_ssl_verify_callback’函数中存在安全漏洞，该漏洞源于程序没有正确验证SSL证书。远程攻击者可借助任意可信的CA证书利用该漏洞实施中间人攻击欺骗服务器。
solution:Upgrade gajim gajim to a higher version than 0.15.2,0.1,0.2,0.2.1,0.3,0.4,0.4.1,0.5,0.5.1,0.6,0.6.1,0.7,0.7.1,0.8,0.8.1,0.8.2,0.9,0.9.1,0.10,0.10.1,0.11,0.11.1,0.11.2,0.11.3,0.11.4,0.12,0.12.1,0.12.2,0.12.3,0.12.4,0.12.5,0.12.5:alpha1,0.12.5:beta1,0.13,0.13.1,0.13.2,0.13.3,0.13.4,0.14,0.14.1,0.14.2,0.14.3,0.14.4,0.15,0.15.1,and avoid the version (,0.15.2],0.1,0.2,0.2.1,0.3,0.4,0.4.1,0.5,0.5.1,0.6,0.6.1,0.7,0.7.1,0.8,0.8.1,0.8.2,0.9,0.9.1,0.10,0.10.1,0.11,0.11.1,0.11.2,0.11.3,0.11.4,0.12,0.12.1,0.12.2,0.12.3,0.12.4,0.12.5,0.12.5:alpha1,0.12.5:beta1,0.13,0.13.1,0.13.2,0.13.3,0.13.4,0.14,0.14.1,0.14.2,0.14.3,0.14.4,0.15,0.15.1