Common Vulnerabilities and Exposures assigned an identifier CVE-2014-0364 to the following vulnerability:

Name: CVE-2014-0364 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0364 Assigned: 20131205 Reference: http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released Reference: CERT-VN:VU#489228 Reference: http://www.kb.cert.org/vuls/id/489228

The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute.

It is not clear whether this flaw affects the version of smack in Fedora. Both of these look to be needed to complete the fix:

http://issues.igniterealtime.org/browse/SMACK-533 http://issues.igniterealtime.org/browse/SMACK-538

Common Vulnerabilities and Exposures assigned an identifier CVE-2014-0363 to the following vulnerability:

Name: CVE-2014-0363 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0363 Assigned: 20131205 Reference: http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released Reference: http://issues.igniterealtime.org/browse/SMACK-410 Reference: CERT-VN:VU#489228 Reference: http://www.kb.cert.org/vuls/id/489228

The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate chain.

The man-in-the-middle attacker requires a certificate that is valid for any domain name.

Upstream patch: http://fisheye.igniterealtime.org/changelog/smackgit?cs=93030c218c62cf0a0a8ea48746db1452fa34033c

From code inspection, this issue affects the 3.2.2 version in Fedora (the CERT advisory mentions version 3.4.1 and possibly earlier versions).