PT-2019-20146 · Twisted Matrix Laboratories · Twisted

Published 2019-06-16 · Updated 2019-06-16

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Twisted versions prior to 19.2.1

Description The issue concerns the XMPP support in Twisted, which failed to verify certificates when used with TLS. This allowed an attacker to perform a man-in-the-middle (MITM) attack on connections.

Recommendations For versions prior to 19.2.1, update to version 19.2.1 or later to resolve the issue.

Related Identifiers

PYSEC-2019-59

Affected Products

Twisted

References · 9

• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PLTZDMFBNFSJMBXYJNGJHENJA4H2TSMZ · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-59 · Vendor Advisory
• https://github.com/twisted/twisted/pull/1147 · Note
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00028.html · Note
• https://oracle.com/security-alerts/cpuapr2020.html · Note
• https://twistedmatrix.com/trac/ticket/9561 · Note
• https://usn.ubuntu.com/4308-2 · Note
• https://usn.ubuntu.com/4308-1 · Note
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00013.html · Note