CVE-2019-12855: twisted Improper Certificate Validation
CVSS: 7.4v3.0HighModified
AliasesSUSE-SU-2019:2453-1openSUSE-SU-2019:2110-1GHSA-65rm-h285-5cc5PYSEC-2019-129UBUNTU-CVE-2019-12855DEBIAN-CVE-2019-12855openSUSE-SU-2019:2068-1
Published 16-06-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-12855 is a high (CVSS 7.4) Improper Certificate Validation vulnerability in twisted. EPSS estimates a 1.81% chance of exploitation in the next 30 days, higher than 78.2% of scored vulnerabilities.
CVSS score
7.4/10
010
High · v3.0 (NVD)EPSS score
1.81%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 3Timeline
- 16-06-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
CVSS metrics
6 scores · 4 sources · 3 versionsCritical 9.1Preferred score · OSV · Pypi (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NSourcesSingle source
High 7.4Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NSourcesAll 4 agree
- OSV · PypiEcosystem advisory · calculated7.4HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated7.4HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.4HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Medium 5.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:NSourcesSingle source
EPSS trend
Probability
1.81%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
0.00 pp
From 1.81% on 19-09-2026
19-09-202619-10-2026
EPSS score1.81%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse10 products
- python-Twisted&distro=HPE Helion OpenStack 8< 15.2.1-9.8.1
- python-Twisted&distro=SUSE Enterprise Storage 4< 15.2.1-9.8.1
- python-Twisted&distro=SUSE Enterprise Storage 5< 15.2.1-9.8.1
- python-Twisted&distro=SUSE Linux Enterprise Module for Web and Scripting 12< 15.2.1-9.8.1
- python-Twisted&distro=SUSE OpenStack Cloud 7< 15.2.1-9.8.1
Opensuse2 products
- python-Twisted&distro=openSUSE Leap 15.0< 17.9.0-lp151.3.6.1
- python-Twisted&distro=openSUSE Leap 15.1< 17.9.0-lp151.3.6.1
Debian1 product
- twisted< 18.9.0-7
PyPI1 product
- twisted< 19.7.0rc1
Twisted1 product
- twisted≤ 19.2.1
Ubuntu1 product
- twisted< 13.2.0-1ubuntu1.2+esm1 | < 16.0.0-1ubuntu0.4 | < 17.9.0-2ubuntu0.1
6 vendors · 16 products
References
27 links- lists.opensuse.org/opensuse-security-announce/2019-09/msg00013.htmlVendor AdvisoryX Refsource SUSEWEB
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00028.htmlVendor AdvisoryX Refsource SUSEWEB
Show all 27 references
- lists.opensuse.org/archives/…Advisory
- github.com/twisted/twistedPACKAGE
- lists.opensuse.org/archives/…Advisory