PyPI/slixmpp CVE-2017-5591: medium 5.9, EPSS 1.73%

SleekXMPP and Slixmpp Incorrect Implementation of Message Carbons

Action: Upgrade slixmpp to 1.2.4 or later.

pip install slixmpp==1.2.4

Affected

Fixed versions

Sources

• osv: GHSA-c35g-jr5f-h83p
• https://nvd.nist.gov/vuln/detail/CVE-2017-5591
• https://github.com/fritzy/SleekXMPP/issues/442
• https://github.com/fritzy/SleekXMPP/commit/285495d5ee2427d93d961ceedcd1829383e5196d
• https://github.com/poezio/slixmpp/commit/22664ee7b86c8e010f312b66d12590fb47160ad8
• https://github.com/poezio/slixmpp
• https://github.com/pypa/advisory-database/tree/main/vulns/sleekxmpp/PYSEC-2017-103.yaml
• https://github.com/pypa/advisory-database/tree/main/vulns/slixmpp/PYSEC-2017-104.yaml
• https://pypi.org/project/sleekxmpp
• https://pypi.org/project/slixmpp
• https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons
• https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf
• https://web.archive.org/web/20200227192025/http://www.securityfocus.com/bid/96166
• http://openwall.com/lists/oss-security/2017/02/09/29

CVE-2017-5591 · published 2022-05-13T01:28:46Z · modified 2024-10-22T18:22:09.103571Z · JSON