Improper Certificate Validation in Twisted

高危 7.4CVE-2019-12855 · GHSA-65rm-h285-5cc5 · PYSEC-2019-129 · Published 16/06/2019 · updated 17/06/2026

要点

CVE-2019-12855 是影响 twisted, twisted (twisted) 的高危 (CVSS 7.4)漏洞。
未来 30 天内被利用的概率（EPSS）：1.8%，高于 78.6% 的漏洞。
修复：升级到 19.7.0rc1 或更高版本。

Package	Affected versions	Patched versions
twisted PyPI	`< 19.7.0rc1`	`19.7.0rc1`
twisted twisted	`≤ 19.2.1`	No fix yet

Description

In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.

NVD description

In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.

References

nvd.nist.gov/vuln/detail/CVE-2019-12855 · ADVISORY
twisted/twisted#1147 · WEB
pypa/advisory-database · WEB
twisted/twisted · PACKAGE
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLTZDMFBNFSJMBXYJNGJHENJA4H2TSMZ · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/PLTZDMFBNFSJMBXYJNGJHENJA4H2TSMZ · WEB
twistedmatrix.com/trac/ticket/9561 · WEB
usn.ubuntu.com/4308-1 · WEB
usn.ubuntu.com/4308-2 · WEB
oracle.com/security-alerts/cpuapr2020.html · WEB
lists.opensuse.org/opensuse-security-announce/2019-09/msg00013.html

twisted 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

twisted

PyPI

< 19.7.0rc1

19.7.0rc1

twisted

≤ 19.2.1

No fix yet

Description

In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.

NVD description

In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.

twisted 的其他漏洞

查看全部 →