id: PYSEC-2017-103
details: 'An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP
  clients allows a remote attacker to impersonate any user, including contacts, in
  the vulnerable application''s display. This allows for various kinds of social engineering
  attacks. This CVE is for SleekXMPP up to 1.3.1 and Slixmpp all versions up to 1.2.3,
  as bundled in poezio (0.8 - 0.10) and other products.'
aliases:
- CVE-2017-5591
- GHSA-c35g-jr5f-h83p
modified: '2021-12-14T08:19:29.328413Z'
published: '2017-02-09T20:59:00Z'
references:
- type: WEB
  url: 
    https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf
- type: WEB
  url: https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/
- type: FIX
  url: 
    https://github.com/poezio/slixmpp/commit/22664ee7b86c8e010f312b66d12590fb47160ad8
- type: WEB
  url: http://openwall.com/lists/oss-security/2017/02/09/29
- type: WEB
  url: http://www.securityfocus.com/bid/96166
- type: PACKAGE
  url: https://pypi.org/project/sleekxmpp
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2017-5591
- type: ADVISORY
  url: https://github.com/advisories/GHSA-c35g-jr5f-h83p
affected:
- package:
    name: sleekxmpp
    ecosystem: PyPI
    purl: pkg:pypi/sleekxmpp
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: '0'
    - fixed: 1.3.2
  versions:
  - '1.0'
  - 1.0beta6
  - 1.0beta6.1
  - 1.0rc1
  - 1.0rc2
  - 1.0rc3
  - 1.1.0
  - 1.1.1
  - 1.1.10
  - 1.1.11
  - 1.1.2
  - 1.1.3
  - 1.1.4
  - 1.1.5
  - 1.1.6
  - 1.1.7
  - 1.1.8
  - 1.1.9
  - 1.2.0
  - 1.2.1
  - 1.2.2
  - 1.2.3
  - 1.2.4
  - 1.2.5
  - 1.3.0
  - 1.3.1