Bug 1902372

Summary:	Pidgin: OMEMO Security problem in lurch and libomemo: 12-byte IVs patch is missing
Product:	[Fedora] Fedora EPEL	Reporter:	Neustradamus <Neustradamus>
Component:	pidgin-epel	Assignee:	Orphan Owner <extras-orphan>
Status:	CLOSED EOL	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	epel7	CC:	carl, extras-orphan
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-06-15 16:38:09 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Neustradamus 2020-11-28 07:46:12 UTC

Dear all,

There is a problem for Pidgin and OMEMO (to all current Fedora/RHEL version).

Pidgin is very very used and need a perfect comptability with all OMEMO clients.

Can you see for "lurch" and "libomemo" big problem?

Very important security point: There is a compatiblity problem with all OMEMO clients (E2E).

Can you quickly solve the needed libomemo with the missing 12-byte IVs patch?
- https://github.com/gkdr/libomemo/pull/27

Explaination:
- https://github.com/gkdr/libomemo/issues/24

Already solved in Alpine / Debian / AUR

Thanks in advance.

Regards,

Neustradamus

Comment 1 Carl George 🤠 2021-06-15 16:38:09 UTC

pidgin-epel is retired (see bug 1972323) because pidgin is in RHEL since 7.3.  If this is still an issue with the RHEL pidgin package, please file a bug under the RHEL7 product and pidgin component.