~ / search / GHSA-98hf-m87w-cq6h

GHSA-98hf-m87w-cq6h

Mellium allows Authentication Bypass by Spoofing

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-46957

Packages

EcosystemPackageAffectedFixed in
Go mellium.im/xmpp < 0.22.0 0.22.0

Details

As written in the advisory (Markdown source, shown as plain text).

Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing because the stanza type is not checked. This is fixed in 0.22.0.

References

External links from the advisory. They lead to third-party sites.