GHSA-c35g-jr5f-h83p

Source

https://github.com/advisories/GHSA-c35g-jr5f-h83p

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-c35g-jr5f-h83p/GHSA-c35g-jr5f-h83p.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-c35g-jr5f-h83p

Aliases

Published

2022-05-13T01:28:46Z

Modified

2024-10-22T17:58:08.627464Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

SleekXMPP and Slixmpp Incorrect Implementation of Message Carbons

Details

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for SleekXMPP up to 1.3.1 and Slixmpp all versions up to 1.2.3, as bundled in poezio (0.8 - 0.10) and other products.

Database specific

{
    "nvd_published_at": "2017-02-09T20:59:00Z",
    "cwe_ids": [
        "CWE-940"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-03T23:06:53Z"
}

References

Affected packages

PyPI / slixmpp

Package

Name: slixmpp; View open source insights on deps.dev
Purl: pkg:pypi/slixmpp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.4

Affected versions

1.*

1.0

1.0.post1

1.0.post2

1.0.post3

1.0.post4

1.0.post5

1.1

1.2

1.2.1

1.2.2

1.2.3

Database specific

{
    "last_known_affected_version_range": "<= 1.2.3"
}

PyPI / sleekxmpp

Package

Name: sleekxmpp; View open source insights on deps.dev
Purl: pkg:pypi/sleekxmpp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.2

Affected versions

1.*

1.0beta6.1

1.0beta6

1.0rc1

1.0rc2

1.0rc3

1.0

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.1.8

1.1.9

1.1.10

1.1.11

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.3.0

1.3.1

Database specific

{
    "last_known_affected_version_range": "<= 1.3.1"
}