The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4 when connecting to a \legacy Jabber server \ does not properly enforce the WockyConnector:tls-required flag which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks.