CVE-2017-5591: Impersonation Vulnerability in SleekXMPP
Summary
CVE-2017-5591: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. Affects sleekxmpp versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Also tracked for
The same CVE-2017-5591 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SleekXMPP is a Python library for XMPP (Extensible Messaging and Presence Protocol) communication. It provides an easy-to-use interface for building XMPP clients and servers. SleekXMPP allows developers to create applications that can send and receive messages, presence updates, and other XMPP-related functionalities. However, versions up to 1.3.1 of SleekXMPP are affected by an impersonation vulnerability.
Vulnerability Detail
The vulnerability, identified as CVE-2017-5591, is related to the incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients, including SleekXMPP. This flaw allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This opens up the possibility of various social engineering attacks, where the attacker can deceive users by appearing as someone they trust. The vulnerability affects SleekXMPP versions up to 1.3.1 and Slixmpp versions up to 1.2.3, as bundled in poezio (0.8 - 0.10) and other products.
How To Fix
Minimum fixed version
1.3.2
This is the first release that contains the fix.
pip install --upgrade "sleekxmpp==1.3.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The impersonation vulnerability in SleekXMPP allows remote attackers to deceive users by impersonating any user in the application's display. To mitigate this vulnerability, it is crucial to update the SleekXMPP package to version 1.3.2 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sleekxmpp →
FAQ
SleekXMPP is a Python library for XMPP communication, providing an interface for building XMPP clients and servers.
The vulnerability allows a remote attacker to impersonate any user in the vulnerable application's display, enabling social engineering attacks.
Versions up to 1.3.1 of SleekXMPP are affected by this vulnerability.
No, there are no known workarounds for this vulnerability. It is recommended to update to the fixed version.
You can update SleekXMPP to the fixed version (1.3.2 or later) by running the command 'pip install --upgrade sleekxmpp'.
Related vulnerabilities
Recent vulnerabilities recorded for sleekxmpp.
