GitHub Advisoryadvisory · PyPI

GHSA-65rm-h285-5cc5 Improper Certificate Validation in Twisted

CRITICAL Published 2019-08-16 Modified 2024-11-25 Official page ↗
Aliases
CVE-2019-12855
Ecosystem
PyPI
Packages
Twisted
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-295
Reviewed
2019-08-12

Affected packages

• PyPI Twisted: < 19.7.0rc1 → fixed in 19.7.0rc1

Description

In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.

Related

Alias · CVE (1)

  • CVE-2019-12855 In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References