Lucene search
GoogleOSV:PYSEC-2017-104HistoryFeb 09, 2017 - 8:59 p.m.
PYSEC-2017-104
2017-02-0920:59:00
Google
osv.dev
10
EPSS
0.004
Percentile
73.1%
An incorrect implementation of “XEP-0280: Message Carbons” in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application’s display. This allows for various kinds of social engineering attacks. This CVE is for SleekXMPP up to 1.3.1 and Slixmpp all versions up to 1.2.3, as bundled in poezio (0.8 - 0.10) and other products.
References
openwall.com/lists/oss-security/2017/02/09/29
www.securityfocus.com/bid/96166
github.com/poezio/slixmpp/commit/22664ee7b86c8e010f312b66d12590fb47160ad8
nvd.nist.gov/vuln/detail/CVE-2017-5591
pypi.org/project/slixmpp
rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/
rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf
Related
osv
osv
SleekXMPP and Slixmpp Incorrect Implementation of Message Carbons
2022-05-13 01:28:46
PYSEC-2017-103
2017-02-09 20:59:00
CVE-2017-5591
2017-02-09 20:59:00
nessus
nessus
Fedora 24 : python-sleekxmpp (2017-97e65f13bb)
2017-04-13 00:00:00
Fedora 26 : python-sleekxmpp (2017-68bd2a916e)
2017-07-17 00:00:00
Fedora 25 : python-sleekxmpp (2017-99ad80f109)
2017-04-13 00:00:00
ubuntucve
ubuntucve
CVE-2017-5591
2017-02-09 00:00:00
nvd
nvd
CVE-2017-5591
2017-02-09 20:59:00
CVE-2017-5589
2017-02-09 20:59:00
fedora
fedora
[SECURITY] Fedora 26 Update: python-sleekxmpp-1.3.2-1.fc26
2017-04-12 14:54:58
[SECURITY] Fedora 24 Update: python-sleekxmpp-1.3.2-1.fc24
2017-04-12 19:50:48
[SECURITY] Fedora 25 Update: python-sleekxmpp-1.3.2-1.fc25
2017-04-12 20:24:15
cve
cve
CVE-2017-5591
2017-02-09 20:59:00
CVE-2017-5589
2017-02-09 20:59:00
debiancve
debiancve
CVE-2017-5591
2017-02-09 20:59:00
cvelist
cvelist
CVE-2017-5591
2017-02-09 20:00:00
CVE-2017-5589
2017-02-09 20:00:00
openvas
openvas
Fedora Update for python-sleekxmpp FEDORA-2017-99ad80f109
2017-04-13 00:00:00
Fedora Update for python-sleekxmpp FEDORA-2017-97e65f13bb
2017-04-13 00:00:00
veracode
veracode
Social Engineering Attack Via Impersonation
2017-02-10 01:55:19
prion
prion
Design/Logic Flaw
2017-02-09 20:59:00
Design/Logic Flaw
2017-02-09 20:59:00
github
github
SleekXMPP and Slixmpp Incorrect Implementation of Message Carbons
2022-05-13 01:28:46
archlinux
archlinux
[ASA-201702-11] kdenetwork-kopete: content spoofing
2017-02-12 00:00:00
zdt
zdt
XMPP Clients User Impersonation Vulnerability
2017-02-10 00:00:00