CVSS 3.0
7.4 highCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NCVE-2019-12855
High (7.4) in twisted twisted. EPSS 1.8% chance of exploitation in the next 30 days. Fixed in twisted 19.7.0rc1.
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
Severity
- EPSS
- 1.8% chance of exploitation in the next 30 days; higher than 78% of CVEs (scores of 2026-10-31)
- CWE
- CWE-295
- Published
- Modified
- Record from
- the NVD, synced
Affected
- twisted:twisted
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-65rm-h285-5cc5 | PyPI | twisted | <19.7.0rc1 | 19.7.0rc1 |
| PYSEC-2019-129 | PyPI | twisted | <19.7.0rc1 | 19.7.0rc1 |
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00013.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00028.html
- https://github.com/twisted/twisted/pull/1147
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLTZDMFBNFSJMBXYJNGJHENJA4H2TSMZ/
- https://twistedmatrix.com/trac/ticket/9561