slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-284.
Summary
slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all of the contacts of the victim can see private data having been published to a PEP node. This attack appears to be exploitable if the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability appears to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in slixmpp 1.4.2.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | slixmpp (PyPI) | before 1.4.2 | 1.4.2 | Patch available | GHSA-4g62-mfwx-4q48 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- slixmpp (PyPI) Vendor— Affected before 1.4.2 Fixed in 1.4.2 Patch available GHSA-4g62-mfwx-4q48
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:slixmpp_project:slixmpp:*:*:*:*:*:*:*:* | before 1.4.2 | Vulnerable | Slixmpp Project |
- cpe:2.3:a:slixmpp_project:slixmpp:*:*:*:*:*:*:*:* Versions before 1.4.2 Vulnerable ·Slixmpp Project
Remediation
- Fix · GHSA-4g62-mfwx-4q48 slixmpp (PyPI) Fixed in 1.4.2 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2019-1000021
- 2026-10-03 Alias added: GHSA-4g62-mfwx-4q48
References
Advisory 3
Other 5
- https://github.com/poezio/slixmpp/commit/7cd73b594e8122dddf847953fcfc85ab4d316416
- https://github.com/poezio/slixmpp
- https://github.com/pypa/advisory-database/tree/main/vulns/slixmpp/PYSEC-2019-121.yaml
- https://lists.fedoraproject.org/archives/list/[email protected]/message/GKBXN7EAAR7ENEZUBKV6C6MP6QBXYTWT
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WIBP4LD2V4TBJSLZXDUAGQMD6CUI2TZR
More Slixmpp Project Slixmpp vulnerabilities
- TI-2022-22262 Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an… CVSS 3.1HIGH 7.5
- TI-2017-03593 An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients… CVSS 3.1MEDIUM 5.9
Sources
- CVE-2019-1000021 · CVE Program
- CVE-2019-1000021 · NVD
- FIRST EPSS
- GHSA-4g62-mfwx-4q48 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-1000021 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences