CVE-2019-1000021: Access Control Vulnerability in slixmpp
Summary
CVE-2019-1000021: slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the c... Affects slixmpp versions < 1.4.2. Fixed in 1.4.2. How to fix ↓
Also tracked for
- slixmpp · Debian:11
The same CVE-2019-1000021 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
slixmpp is a Python library that provides a simple and intuitive API for XMPP (Extensible Messaging and Presence Protocol) communication. It allows developers to build XMPP clients and servers with ease. The library supports various XMPP extensions and plugins, including XEP-0223, which enables persistent storage of private data via PubSub (Publish-Subscribe).
Vulnerability Detail
The slixmpp library before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in the XEP-0223 plugin. This vulnerability allows all contacts of a victim to see private data that has been published to a PEP (Personal Eventing Protocol) node. The vulnerability can be exploited if the user of the library publishes any private data on PEP and the node is not configured to be private. The impact of this vulnerability is the unauthorized disclosure of sensitive information to unintended recipients.
How To Fix
Latest published version: 1.17.0 as of 23 Oct 2026
pip install --upgrade "slixmpp==1.17.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.2
This is the first release that contains the fix.
pip install --upgrade "slixmpp==1.4.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to update to the fixed version of slixmpp to mitigate the issue.
Conclusion
The Access Control vulnerability in slixmpp's XEP-0223 plugin allows unauthorized disclosure of private data to all contacts of a victim. It is crucial to update to slixmpp version 1.4.2 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for slixmpp →
FAQ
slixmpp is a Python library for XMPP communication, allowing developers to build XMPP clients and servers.
XEP-0223 is an XMPP extension that enables persistent storage of private data via PubSub.
A PEP node is a Personal Eventing Protocol node where XMPP clients can publish and retrieve personal data.
This vulnerability can be exploited if the user of the slixmpp library publishes private data on a non-private PEP node, allowing all contacts to see the published data.
To fix this vulnerability, update your slixmpp installation to version 1.4.2 or later.
Related vulnerabilities
Recent vulnerabilities recorded for slixmpp.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
