Back to Database
Status published
High
CVE-2019-12855
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not...
Vulnerability Description
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-12855
Credits & Attribution
No credits recorded in the NVD database.
References
- https://twistedmatrix.com/trac/ticket/9561
- https://github.com/twisted/twisted/pull/1147
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLTZDMFBNFSJMBXYJNGJHENJA4H2TSMZ/
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00013.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00028.html
- https://usn.ubuntu.com/4308-2/
- https://usn.ubuntu.com/4308-1/
- https://www.oracle.com/security-alerts/cpuapr2020.html
More from twisted
View All →CVE-2024-41810
HTML injection in HTTP redirect body
Medium
6.1
CVE-2024-41671
twisted.web has disordered HTTP pipeline response
High
8.3
CVE-2023-46137
twisted.web has disordered HTTP pipeline response
Medium
5.3
CVE-2022-39348
Twisted vulnerable to NameVirtualHost Host header injection
Medium
5.4
CVE-2022-24801
HTTP Request Smuggling in twisted.web
High
8.1
Affected Vendor
twisted
View all reports →Affected Software
twisted
Vulnerable Versions:
0
Timeline
Official Publish:
June 16th, 2019
Last Modified:
August 4th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.