Is it really a huge vulnerability? But certainly a very dickish bug entry.
Do you think that using SSL where your client accepts every certificate (the link points to a function that returns a success code unconditionally, the 'real' stuff is disabled by preprocessor directives) is bad?
Whatever the severity (for me this is certainly high), the tone in that bug report is inexcusable.
Edit: Well, it seems that code existed like this since its creation, 2003-09-29: http://hg.pidgin.im/pidgin/main/rev/895a5ff9ebd4
Edit 2: The bug report has now a proper response, quite relaxed. So it seems this is totally expected - for whatever reasons. I'm still curious why the code is littered with #if 0 fragments for years (dead code belongs in the vcs history for me), but the initial expectation of a total lack of certificate verification is wrong.
Twitter(!) has the news as it broke/continues to break:
> .. the most widely used(?) open source IM client library, libpurple?
At the very least, would have been a great place in the code to comment on where (since obviously not there) the cert is supposed to get validated!
That's how bad it is.