GHSA-65rm-h285-5cc5

Improper Certificate Validation in Twisted

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-12855

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	Twisted	< 19.7.0rc1	19.7.0rc1

Details

As written in the advisory (Markdown source, shown as plain text).

In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-12855 advisory
https://github.com/twisted/twisted/pull/1147 web
https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2019-129.yaml web
https://github.com/twisted/twisted package
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLTZDMFBNFSJMBXYJNGJHENJA4H2TSMZ web
https://lists.fedoraproject.org/archives/list/[email protected]/message/PLTZDMFBNFSJMBXYJNGJHENJA4H2TSMZ web
https://twistedmatrix.com/trac/ticket/9561 web
https://usn.ubuntu.com/4308-1 web
https://usn.ubuntu.com/4308-2 web
https://www.oracle.com/security-alerts/cpuapr2020.html web
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00013.html web
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00028.html web