Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTY1cm0taDI4NS01Y2M1

Improper Certificate Validation in Twisted

In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.

Permalink: https://github.com/advisories/GHSA-65rm-h285-5cc5
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTY1cm0taDI4NS01Y2M1
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 5 years ago
Updated: 3 days ago

CVSS Score: 7.4
CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Identifiers: GHSA-65rm-h285-5cc5, CVE-2019-12855
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-12855
• https://github.com/twisted/twisted/pull/1147
• https://twistedmatrix.com/trac/ticket/9561
• https://github.com/advisories/GHSA-65rm-h285-5cc5
• https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2019-129.yaml
• https://lists.fedoraproject.org/archives/list/[email protected]/message/PLTZDMFBNFSJMBXYJNGJHENJA4H2TSMZ
• https://usn.ubuntu.com/4308-1
• https://usn.ubuntu.com/4308-2
• https://www.oracle.com/security-alerts/cpuapr2020.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00013.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00028.html

Repository: https://github.com/twisted/twisted
Blast Radius: 29.1

Affected Packages