CVE-2017-5591: Impersonation Vulnerability in Slixmpp
Summary
CVE-2017-5591: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. Affects slixmpp across 2 version ranges.
< 1.2.4
< 22664ee7b86c8e010f312b66d12590fb47160ad8
Fixed in 22664ee7b86c8e010f312b66d12590fb47160ad8. How to fix ↓
Also tracked for
The same CVE-2017-5591 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Slixmpp is a Python library that provides XMPP (Extensible Messaging and Presence Protocol) functionality. It is used by various XMPP clients, including poezio. XMPP is a communication protocol used for instant messaging, presence information, and contact list management. Slixmpp allows developers to create XMPP clients and servers with ease. However, a vulnerability in the implementation of the "XEP-0280: Message Carbons" feature in Slixmpp versions up to 1.2.3 and SleekXMPP up to 1.3.1, as bundled in poezio (0.8 - 0.10), allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This vulnerability opens the door for various social engineering attacks.
Vulnerability Detail
The vulnerability arises from an incorrect implementation of the "XEP-0280: Message Carbons" feature in Slixmpp and SleekXMPP. This flaw enables a remote attacker to impersonate any user, including contacts, in the affected application's display. By exploiting this vulnerability, an attacker can deceive users into believing they are interacting with a trusted contact, leading to potential social engineering attacks. The vulnerability affects Slixmpp versions up to 1.2.3 and SleekXMPP versions up to 1.3.1, as bundled in poezio (0.8 - 0.10).
How To Fix
Latest published version: 1.17.0 as of 23 Oct 2026
pip install --upgrade "slixmpp==1.17.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
22664ee7b86c8e010f312b66d12590fb47160ad8
This is the first release that contains the fix.
pip install --upgrade "slixmpp==22664ee7b86c8e010f312b66d12590fb47160ad8"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the affected library to the fixed version as soon as possible.
Conclusion
The impersonation vulnerability in Slixmpp and SleekXMPP versions up to 1.3.1, as bundled in poezio, allows remote attackers to deceive users by impersonating any user or contact in the application's display. To mitigate this vulnerability, it is crucial to update the affected library to version 1.2.4 or later. Developers should also implement proper user identity validation and authentication in their XMPP clients. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for slixmpp →
FAQ
Slixmpp is a Python library that provides XMPP functionality. It allows developers to create XMPP clients and servers.
"XEP-0280: Message Carbons" is an XMPP extension protocol that enables message synchronization across multiple devices.
The vulnerability allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This can lead to social engineering attacks and deception of users.
Slixmpp versions up to 1.2.3 are affected by this vulnerability.
To protect your application, update the Slixmpp library to version 1.2.4 or later. Ensure that your XMPP client properly validates and authenticates user identities.
Related vulnerabilities
Recent vulnerabilities recorded for slixmpp.
