Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1tNjU4LXAyNHgtcDc0cs0rEA

TLS certificate validation error in mellium.im/xmpp

In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail. This occurs because the wrong host name is selected during this verification.

Permalink: https://github.com/advisories/GHSA-m658-p24x-p74r
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tNjU4LXAyNHgtcDc0cs0rEA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 years ago
Updated: 8 months ago

CVSS Score: 5.9
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Identifiers: GHSA-m658-p24x-p74r, CVE-2022-24968
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-24968
• https://mellium.im/cve/cve-2022-24968/
• https://mellium.im/xmpp/
• https://github.com/mellium/xmpp/pull/260
• https://github.com/mellium/xmpp/commit/0d92aa486da69b71f2f4a30e62aa722c711b98ac
• https://mellium.im/issue/259
• https://pkg.go.dev/vuln/GO-2022-0370
• https://github.com/advisories/GHSA-m658-p24x-p74r

Repository: https://github.com/mellium/xmpp
Blast Radius: 6.6

Affected Packages