CVE-2019-12855: Twisted XMPP Support TLS Certificate Verification Bypass
Summary
CVE-2019-12855: In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections. Affects twisted versions < 19.7.0rc1. Fixed in 19.7.0rc1. How to fix ↓
Also tracked for
- twisted · Debian:11
The same CVE-2019-12855 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Twisted is an event-driven networking engine written in Python. It provides support for building networked applications, including protocols such as XMPP. XMPP is a communication protocol used for instant messaging and presence information. Twisted's XMPP support allows developers to create XMPP clients and servers. However, prior to version 19.7.0rc1, Twisted did not properly verify certificates when used with TLS, which could allow an attacker to perform a man-in-the-middle (MITM) attack on XMPP connections.
Vulnerability Detail
The vulnerability in Twisted's XMPP support arises from the lack of certificate verification when using TLS. This means that an attacker could intercept and modify XMPP traffic without being detected. By performing a MITM attack, an attacker could potentially eavesdrop on conversations, inject malicious content, or impersonate legitimate XMPP entities. This vulnerability poses a significant risk to the confidentiality, integrity, and authenticity of XMPP communications.
How To Fix
Latest published version: 26.4.0 as of 23 Oct 2026
pip install --upgrade "twisted==26.4.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
19.7.0rc1
This is the first release that contains the fix.
pip install --upgrade "twisted==19.7.0rc1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can manually implement certificate verification in their XMPP applications. This involves validating the server's certificate against a trusted certificate authority (CA) and checking for any certificate errors. By implementing proper certificate verification, developers can mitigate the risk of a MITM attack. Here is an example of how to perform certificate verification using Twisted's XMPP support:
from twisted.internet import ssl
from twisted.words.protocols.jabber import client
# Create an SSL context with certificate verification
contextFactory = ssl.ClientContextFactory()
# Create an XMPP client with the SSL context
xmppClient = client.XMPPClient(contextFactory)
# Connect to the XMPP server
xmppClient.connect()
Note: This workaround should only be used if upgrading to the latest version of Twisted is not immediately feasible.
Conclusion
In conclusion, the Twisted XMPP support prior to version 19.7.0rc1 is vulnerable to a TLS certificate verification bypass. This vulnerability could enable a man-in-the-middle attack on XMPP connections, compromising the security of communications. It is recommended to upgrade to the latest version of Twisted or implement manual certificate verification to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for twisted →
FAQ
Twisted is an event-driven networking engine written in Python. It provides support for building networked applications, including protocols such as XMPP.
XMPP (Extensible Messaging and Presence Protocol) is a communication protocol used for instant messaging and presence information.
Certificate verification is the process of validating the authenticity and integrity of a digital certificate. It involves checking the certificate against a trusted certificate authority (CA) and verifying that it has not been tampered with.
A man-in-the-middle (MITM) attack is a type of cyber attack where an attacker intercepts and modifies communication between two parties without their knowledge. In the context of this vulnerability, it refers to an attacker intercepting and modifying XMPP traffic between a client and server.
This vulnerability could allow an attacker to eavesdrop on XMPP conversations, inject malicious content, or impersonate legitimate XMPP entities. It poses a risk to the confidentiality, integrity, and authenticity of XMPP communications.
Related vulnerabilities
Recent vulnerabilities recorded for twisted.
