vulnwire
5.9med

CVE-2017-5591

SleekXMPP and Slixmpp Incorrect Implementation of Message Carbons

Also known as GHSA-c35g-jr5f-h83p, PYSEC-2017-103, PYSEC-2017-104

Published 9 y ago · modified 4 mo ago · JSON

CVSS
5.9
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
1.7%
percentile 78%
Public exploits
0
none known

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for SleekXMPP up to 1.3.1 and Slixmpp all versions up to 1.2.3, as bundled in poezio (0.8 - 0.10) and other products.

Exploit prediction (EPSS)

1.73% probability of exploitation in the next 30 days, higher than 78% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.15.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:P/A:N
GitHub3.15.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

EcosystemPackageAffectedFixed in
pypislixmpp
<1.2.4
1.2.4
pypisleekxmpp
<1.3.2
1.3.2

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-346 Origin Validation Error
  • CWE-940 Improper Verification of Source of a Communication Channel

References

  • securityfocus.com /bid/96166 · vdb-entry, x_refsource_BID, x_transferred
  • openwall.com /lists/oss-security/2017/02/09/29 · x_refsource_MISC, x_transferred
  • rt-solutions.de /en/2017/02/CVE-2017-5589_xmpp_carbons/ · x_refsource_MISC, x_transferred
  • rt-solutions.de /wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf · x_refsource_MISC, x_transferred
  • github.com /poezio/slixmpp/commit/22664ee7b86c8e010f312b66d12590fb47160ad8 · x_refsource_MISC, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-5591 · advisory
  • github.com /fritzy/SleekXMPP/issues/442 · web
  • github.com /fritzy/SleekXMPP/commit/285495d5ee2427d93d961ceedcd1829383e5196d · web
  • github.com /poezio/slixmpp · package
  • github.com /pypa/advisory-database/tree/main/vulns/sleekxmpp/PYSEC-2017-103.yaml · web
  • github.com /pypa/advisory-database/tree/main/vulns/slixmpp/PYSEC-2017-104.yaml · web
  • pypi.org /project/sleekxmpp · web
  • pypi.org /project/slixmpp · web
  • rt-solutions.de /en/2017/02/CVE-2017-5589_xmpp_carbons · web
  • web.archive.org /web/20200227192025/http://www.securityfocus.com/bid/96166 · web
  • github.com /advisories/GHSA-c35g-jr5f-h83p · advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.