Junglewise Threat Intelligence

GO-2021-0321 - An attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing

Severity: info · Published 2022-03-15

Technologies: mellium.im/xmpp (Go). Vendors: Go.

Executive brief

An attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail. This occurs because the wrong host name is selected during this verification.

Affected products

  • Go mellium.im/xmpp

Related threats