CVE-2019-12855 Improper Certificate Validation in Twisted
Attackers can perform man-in-the-middle attacks on XMPP connections because the Twisted library fails to verify TLS certificates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-12855?
CVE-2019-12855 is a high-severity vulnerability in n/a, published on 16 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
Weakness: CWE-295
Which versions are affected by CVE-2019-12855?
3 open source packages ship an affected version, including twisted and Twisted. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
twisted PyPI | All versions | 19.7.0rc1 |
twisted PyPI | All versions | 19.7.0rc1 |
Twisted PyPI | All versions | 19.7.0rc1 |
Linux distribution packages (12)
python-Twisted SUSE:Enterprise Storage 4 | All versions | 15.2.1-9.8.1 |
python-Twisted SUSE:Enterprise Storage 5 | All versions | 15.2.1-9.8.1 |
python-Twisted SUSE:HPE Helion OpenStack 8 | All versions | 15.2.1-9.8.1 |
python-Twisted SUSE:Linux Enterprise Module for Web and Scripting 12 | All versions | 15.2.1-9.8.1 |
python-Twisted SUSE:OpenStack Cloud 7 | All versions | 15.2.1-9.8.1 |
python-Twisted SUSE:OpenStack Cloud 8 | All versions | 15.2.1-9.8.1 |
python-Twisted SUSE:OpenStack Cloud 9 | All versions | 15.2.1-9.8.1 |
python-Twisted SUSE:OpenStack Cloud Crowbar 8 | All versions | 15.2.1-9.8.1 |
python-Twisted SUSE:OpenStack Cloud Crowbar 9 | All versions | 15.2.1-9.8.1 |
python-Twisted SUSE:Package Hub 15 | All versions | 17.9.0-bp150.4.6.1 |
python-Twisted openSUSE:Leap 15.0 | All versions | 17.9.0-lp151.3.6.1 |
python-Twisted openSUSE:Leap 15.1 | All versions | 17.9.0-lp151.3.6.1 |
Products include Twisted Twisted.
How do I fix CVE-2019-12855?
Upgrade twisted to 19.7.0rc1 or later.
Is CVE-2019-12855 being exploited?
There is no known exploitation of CVE-2019-12855 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-42304 Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains
- CVE-2014-7143 Python Twisted trustRoot is not respected in HTTP client
- CVE-2024-41810 HTML injection in HTTP redirect body
- CVE-2023-46137 twisted.web has disordered HTTP pipeline response
- CVE-2016-1000111 Forced Browsing in Twisted
Sources
Also known as AZL-6818, DEBIAN-CVE-2019-12855, GHSA-65rm-h285-5cc5, PYSEC-2019-129, SUSE-SU-2019:2212-1, SUSE-SU-2019:2453-1 and 3 more.