Executive brief
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
Affected products
- PyPI twisted
Junglewise Threat Intelligence
CVE-2019-12855: PYSEC-2019-129 - In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an atta
CVE-2019-12855 · Severity: low · CVSS 3 · Published 2019-06-16
Technologies: twisted (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1992 - twisted.web has disordered HTTP pipeline response
- PYSEC-2026-1055 - Twisted vulnerable to NameVirtualHost Host header injection
- Twisted Denial of Service via DNS compression pointer chains
- PYSEC-2024-75 - Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains a
- PYSEC-2023-224 - Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP p