CVE-2022-45197 Slixmpp lacks SSL Certificate hostname validation in XMLStream
An attacker can bypass SSL certificate hostname validation in Slixmpp, allowing them to impersonate any server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-45197?
CVE-2022-45197 is a high-severity vulnerability in n/a, published on 25 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.
Weakness: CWE-295
Which versions are affected by CVE-2022-45197?
3 open source packages ship an affected version, including slixmpp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
slixmpp PyPI | All versions | 1.8.3 |
slixmpp PyPI | All versions | 1.8.3 |
slixmpp PyPI | All versions | 1.8.3 |
Linux distribution packages (5)
python-slixmpp SUSE:Package Hub 15 SP3 | All versions | 1.4.2-bp153.2.3.1 |
python-slixmpp SUSE:Package Hub 15 SP4 | All versions | 1.4.2-bp154.2.3.1 |
python-slixmpp openSUSE:Leap 15.3 | All versions | 1.4.2-bp153.2.3.1 |
python-slixmpp openSUSE:Leap 15.4 | All versions | 1.4.2-bp154.2.3.1 |
python-slixmpp openSUSE:Tumbleweed | All versions | 1.8.6-1.1 |
Products include Slixmpp Project Slixmpp.
How do I fix CVE-2022-45197?
Upgrade slixmpp to 1.8.3 or later.
Is CVE-2022-45197 being exploited?
There is no known exploitation of CVE-2022-45197 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2022-45197, GHSA-q6cq-m9gm-6q2f, MGASA-2022-0469, PYSEC-2022-43013, UBUNTU-CVE-2022-45197, openSUSE-SU-2022:10241-1 and 3 more.