PT-2018-3492 · Twisted Matrix Laboratories+3 · Twisted+3

Published 2018-11-24 · Updated 2024-11-25 · CVE-2019-12855

Positive Technologies (AI Summary)

CVSS v4.0

9.1

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Twisted versions through 19.2.1

Description: The issue is related to the XMPP support in the words.protocols.jabber.xmlstream module of the Twisted network framework, which did not verify certificates when used with TLS. This allows an attacker to perform a man-in-the-middle (MITM) attack on connections. The vulnerability can be exploited by a remote attacker to intercept and manipulate data.

Recommendations: For Twisted versions through 19.2.1, update to a version that verifies certificates when using TLS to prevent MITM attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

AZL-6818

BDU:2020-02755

CVE-2019-12855

GHSA-65RM-H285-5CC5

MGASA-2019-0360

OPENSUSE-SU-2019:2068-1

OPENSUSE-SU-2019:2110-1

OPENSUSE-SU-2019_2068-1

OPENSUSE-SU-2024:11212-1

PYSEC-2019-129

SUSE-SU-2019:2212-1

SUSE-SU-2019:2453-1

SUSE-SU-2019_2212-1

SUSE-SU-2019_2453-1

USN-4308-1

USN-4308-2

Affected Products

Astra Linux

Suse

Twisted

Ubuntu

References · 54

• https://github.com/twisted/twisted/pull/1147 · Patch
• https://cve.org/CVERecord?id=CVE-2019-12855 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00013.html · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-129 · Vendor Advisory
• https://twistedmatrix.com/trac/ticket/9561 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-1121SE47 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11212-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2110-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-12855 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLTZDMFBNFSJMBXYJNGJHENJA4H2TSMZ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12855 · Security Note
• https://usn.ubuntu.com/4308-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-12855 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4308-2 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0360 · Vendor Advisory