Description
The Quick Connection dialog in Konversation 0.15 inadvertently uses the user-provided password as the nickname instead of the user-provided nickname when connecting to the IRC server, which could leak the password to other users.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | konversation | 0.15-3 | — |
| Debian 13 | konversation | 0.15-3 | — |
| Debian 12 | konversation | 0.15-3 | — |
References
- 13919 third-party-advisory
- 20050119 Multiple vulnerabilities in Konversation mailing-list
- http://www.kde.org/info/security/advisory-20050121-1.txt
- 12312 vdb-entry
- 13989 third-party-advisory
- konversation-nick-password-information-disclosure(19038) vdb-entry
- GLSA-200501-34 vendor-advisory
- 20050119 Multiple vulnerabilities in Konversation mailing-list
- 1012972 vdb-entry