GHSA-m658-p24x-p74r: Duplicate Advisory: TLS certificate validation error in mellium.im/xmpp

February 12, 2022 (updated May 20, 2024)

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-h289-x5wc-xcv8. This link is maintained to preserve external references.

Original Description

In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail. This occurs because the wrong host name is selected during this verification.

References

github.com/advisories/GHSA-m658-p24x-p74r
github.com/mellium/xmpp/commit/0d92aa486da69b71f2f4a30e62aa722c711b98ac
github.com/mellium/xmpp/pull/260
mellium.im/cve/cve-2022-24968
mellium.im/issue/259
mellium.im/xmpp
nvd.nist.gov/vuln/detail/CVE-2022-24968
pkg.go.dev/vuln/GO-2022-0370

Detect and mitigate GHSA-m658-p24x-p74r with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →