CVE-2017-5591 SleekXMPP and Slixmpp Incorrect Implementation of Message Carbons
MediumCVSS 5.9
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for SleekXMPP up to 1.3.1 and Slixmpp all versions up to 1.2.3, as bundled in poezio (0.8 - 0.10) and other products.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi slixmpp(PyPI) | < 1.2.4 | 1.2.4 |
| pypi slixmpp(PyPI) | = 1.0 | No fix listed |
| pypi slixmpp(PyPI) | = 1.0.post1 | No fix listed |
| pypi slixmpp(PyPI) | = 1.0.post2 | No fix listed |
| pypi slixmpp(PyPI) | = 1.0.post3 | No fix listed |
| pypi slixmpp(PyPI) | = 1.0.post4 | No fix listed |
| pypi slixmpp(PyPI) | = 1.0.post5 | No fix listed |
| pypi slixmpp(PyPI) | = 1.1 | No fix listed |
| pypi slixmpp(PyPI) | = 1.2 | No fix listed |
| pypi slixmpp(PyPI) | = 1.2.1 | No fix listed |
| pypi slixmpp(PyPI) | = 1.2.2 | No fix listed |
| pypi slixmpp(PyPI) | = 1.2.3 | No fix listed |
| pypi sleekxmpp(PyPI) | < 1.3.2 | 1.3.2 |
| pypi sleekxmpp(PyPI) | = 1.0 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.0beta6 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.0beta6.1 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.0rc1 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.0rc2 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.0rc3 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.1.0 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.1.1 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.1.10 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.1.11 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.1.2 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.1.3 | No fix listed |
Show 25 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi sleekxmpp(PyPI) | = 1.1.4 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.1.5 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.1.6 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.1.7 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.1.8 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.1.9 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.2.0 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.2.1 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.2.2 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.2.3 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.2.4 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.2.5 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.3.0 | No fix listed |
| pypi sleekxmpp(PyPI) | = 1.3.1 | No fix listed |
| pypi slixmpp(PyPI) | <= 1.2.3 | No fix listed |
| pypi sleekxmpp(PyPI) | <= 1.3.1 | No fix listed |
| debian/slixmpp(Debian:12) | < 1.2.2-1.1 | 1.2.2-1.1 |
| debian/slixmpp(Debian:13) | < 1.2.2-1.1 | 1.2.2-1.1 |
| debian/slixmpp(Debian:14) | < 1.2.2-1.1 | 1.2.2-1.1 |
| sleekxmpp project sleekxmpp | <= 1.3.1 | No fix listed |
| slixmpp project slixmpp | <= 1.2.3 | No fix listed |
| poezio | = 0.8 | No fix listed |
| poezio | = 0.8.1 | No fix listed |
| poezio | = 0.9 | No fix listed |
| poezio | = 0.10 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com
- github.com patch
- github.com patch
- github.com product
- github.com
- github.com
- pypi.org product
- pypi.org product
- rt-solutions.de exploit technical-description third-party-advisory
- rt-solutions.de exploit technical-description third-party-advisory
- web.archive.org
- openwall.com exploit mailing-list third-party-advisory
- 96166 third-party-advisory vdb-entry
- github.com vendor-advisory
- Debian Security Tracker CVE-2017-5591 vendor-advisory
- bugs.debian.org issue-tracking