id: PYSEC-2017-104
details: 'An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP
  clients allows a remote attacker to impersonate any user, including contacts, in
  the vulnerable application''s display. This allows for various kinds of social engineering
  attacks. This CVE is for SleekXMPP up to 1.3.1 and Slixmpp all versions up to 1.2.3,
  as bundled in poezio (0.8 - 0.10) and other products.'
aliases:
- CVE-2017-5591
modified: '2021-12-14T08:19:29.481755Z'
published: '2017-02-09T20:59:00Z'
references:
- type: WEB
  url: https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf
- type: WEB
  url: https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/
- type: FIX
  url: https://github.com/poezio/slixmpp/commit/22664ee7b86c8e010f312b66d12590fb47160ad8
- type: WEB
  url: http://openwall.com/lists/oss-security/2017/02/09/29
- type: WEB
  url: http://www.securityfocus.com/bid/96166
- type: PACKAGE
  url: https://pypi.org/project/slixmpp
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2017-5591
affected:
- package:
    name: slixmpp
    ecosystem: PyPI
    purl: pkg:pypi/slixmpp
  ranges:
  - type: GIT
    repo: https://github.com/poezio/slixmpp
    events:
    - introduced: '0'
    - fixed: 22664ee7b86c8e010f312b66d12590fb47160ad8
  - type: ECOSYSTEM
    events:
    - introduced: '0'
    - fixed: 1.2.4
  versions:
  - '1.0'
  - 1.0.post1
  - 1.0.post2
  - 1.0.post3
  - 1.0.post4
  - 1.0.post5
  - '1.1'
  - '1.2'
  - 1.2.1
  - 1.2.2
  - 1.2.3