CVE-2019-12855

EPSS 0.55%
Published 16.06.2019 12:29:00
Last modified 25.11.2024 18:12:24
Source cve@mitre.org
Teams watchlist Login
Open Login

In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.

Affected products Warnungen 0 Metrics 3 CWE 1 References 11

Data is provided by the National Vulnerability Database (NVD)

Twisted ≫ Twisted Version <= 19.2.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.55%	0.67

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.4	2.2	5.2	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
nvd@nist.gov	5.8	8.6	4.9	AV:N/AC:M/Au:N/C:P/I:P/A:N

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

https://www.oracle.com/security-alerts/cpuapr2020.html

https://usn.ubuntu.com/4308-1/

https://usn.ubuntu.com/4308-2/

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00013.html

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00028.html

https://github.com/twisted/twisted/pull/1147

Patch

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLTZDMFBNFSJMBXYJNGJHENJA4H2TSMZ/

https://twistedmatrix.com/trac/ticket/9561

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-12855

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-12855

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-12855

EUVD