CVE-2019-12855: High severity Twisted Twisted vulnerability
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/twistedto a version that resolves this vulnerability.Fixed in 19.7.0rc1 - Upgrade
Upgrade
debian/twistedto a version that resolves this vulnerability.Fixed in 20.3.0-7+deb11u1Fixed in 20.3.0-7+deb11u2Fixed in 22.4.0-4+deb12u1Fixed in 24.11.0-1Fixed in 25.5.0-5 - Upgrade
Upgrade
alpine/py3-twistedto a version that resolves this vulnerability.Fixed in 19.7.0-r0
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2019-12855.
What is the severity of CVE-2019-12855?
The severity of CVE-2019-12855 is high with a CVSS score of 7.4.
What is the affected software?
The affected software is Twisted through version 19.2.1.
Is there a fix available for CVE-2019-12855?
Yes, a fix is available in Twisted version 19.7.0 or higher.
Where can I find more information about CVE-2019-12855?
You can find more information about CVE-2019-12855 in the following references: [link1], [link2], [link3].