Executive brief
Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.
Affected products
- PyPI slixmpp
Junglewise Threat Intelligence
CVE-2022-45197: PYSEC-2022-43013 - Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixm
CVE-2022-45197 · Severity: low · CVSS 3.1 · Published 2022-12-25
Technologies: slixmpp (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2019-121 - slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin
- PYSEC-2019-51 - slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin
- PYSEC-2017-104 - An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, includ