Arch Linux

confirmed, downgrading to nss 3.57 fixed pidgin access to google talk for me.

Confirmed. Pidgin debug output:

nss: Handshake failed (-12251)
...

NSS and SSL Error Codes:

SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER -12251 "SSL received a malformed Change Cipher Spec record."

If you don't want to downgrade to NSS 3.57,
another workaround is to limit the TLS/SSL Version to TLS 1.2.
You can do this with the Pidgin Plugin 'NSS Preferences' (nss-prefs.so).

The error is thrown at this point, nss-3.58/nss/lib/ssl/ssl3con.c:

13064 ...... if (ss->version >= SSL_LIBRARY_VERSION_TLS_1_3 &&
13065 .......... cText->hdr[0] == ssl_ct_change_cipher_spec &&
13066 .......... ss->ssl3.hs.ws != idle_handshake &&
13067 .......... cText->buf->len == 1 &&
13068 .......... cText->buf->buf[0] == change_cipher_spec_choice) {
13069 .......... if (ss->ssl3.hs.allowCcs) {
13070 .............. /* Ignore the first CCS. */
13071 .............. ss->ssl3.hs.allowCcs = PR_FALSE;
13072 ............. return SECSuccess;
13073 .......... }
13074
13075 .......... /* Compatibility mode is not negotiated. */
13076 .......... alert = unexpected_message;
13077 .......... PORT_SetError(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER);
13078 ...... }

But I'm not deep enough into NSS and SSL to know exactly what is causing the problem.

I also stumbled upon this with Bitlbee (bitlbee-libpurple) from the AUR. I only started to try this package this week so for a long time I suspected this error to be a config error of mine. Took some time to find this. So I'm commenting here in case others will search for bitlbee in the bug tracker. In Bitlbee I got messages that the SSL handshake failed and in addition, when I looked at the systemd journal for bitlbee, I got the following cryptic error messages, not sure how they are connected:

```
g_object_unref: assertion 'G_IS_OBJECT (object)' failed
rc_update_cookies: assertion 'headers != NULL' failed
g_strstr_len: assertion 'haystack != NULL' failed
```

Downgrading NSS solved those problems

Intentional change in NSS [1] for CVE-2020-25648

[1] https://github.com/nss-dev/nss/commit/e10a362f69191506e73bfa31778da45f4c5df482

Edit:
Does applying the attached patch have any effect?

Your test patch works for me.

By the way -> https://bugzilla.mozilla.org/show_bug.cgi?id=1672703

They are working on a patch for NSS (3.58.1).
It seems that Firefox also uses SSL_ENABLE_TLS13_COMPAT_MODE,
so a patch for Pidgin would also be advisable.

confirmed, patch works with nss 3.58

Can confirm bug, have the effect on two different computers,
chatted with the admin of jabber.de to search for the cause,
he tested same pidgin / libpurple versions on some different
distro, which worked for him. Also I tested jabber chat with
thunderbird on my affected computer - works (so its not router,
firewall, whatever)

Does the proposed upstream fix work. Attached PKGBUILD.diff applying [1].

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1672703#c10
Edit:
Sorry missed deadite66 had already confirmed it.