CVE-2019-12855
Improper Certificate Validation in Twisted
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
- Record
CVE-2019-12855- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List No score
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
- Record
CVE-2019-12855- Updated
- 2026-11-02
EUVDEUVD-2019-0147 No score
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
- Record
EUVD-2019-0147- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-65rm-h285-5cc5
Improper Certificate Validation in Twisted
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
- Record
GHSA-65rm-h285-5cc5- CVSS 4.0
- 9.1 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVAZL-6818
CVE-2019-12855 affecting package python-twisted for versions less than 22.2.0-1
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
- Record
AZL-6818- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVBELL-CVE-2019-12855
CVE-2019-12855 does not affect BellSoft software
- Record
BELL-CVE-2019-12855- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Show 13 moreShow less
OSV
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
- Record
CVE-2019-12855- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-12855
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
- Record
DEBIAN-CVE-2019-12855- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-65rm-h285-5cc5
Improper Certificate Validation in Twisted
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
- Record
GHSA-65rm-h285-5cc5- CVSS 4.0
- 9.1 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-12855
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
- Record
UBUNTU-CVE-2019-12855- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVMGASA-2019-0360 No score
Updated python-twisted packages fix security vulnerabilities
Updated python-twisted packages fix security vulnerabilities:
Improper sanitization of URIs or HTTP which could allow attackers to perform CRLF attacks (CVE-2019-12387).
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections (CVE-2019-12855).
- Record
MGASA-2019-0360- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2068-1 No score
Security update for python-Twisted
This update for python-Twisted fixes the following issues:
Security issue fixed:
- CVE-2019-12855: Fixed TLS certificate verification to protecting against MITM attacks (bsc#1138461).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:2068-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2110-1 No score
Security update for python-Twisted
This update for python-Twisted fixes the following issues:
Security issue fixed:
- CVE-2019-12855: Fixed TLS certificate verification to protecting against MITM attacks (bsc#1138461).
This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project.
- Record
openSUSE-SU-2019:2110-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11212-1 No score
python-Twisted-doc-21.7.0-3.2 on GA media
These are all security issues fixed in the python-Twisted-doc-21.7.0-3.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11212-1- Updated
- 2026-11-02
OSVPYSEC-2019-129 No score
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
- Record
PYSEC-2019-129- Updated
- 2026-11-02
OSVSUSE-SU-2019:2212-1 No score
Security update for python-Twisted
This update for python-Twisted fixes the following issues:
Security issue fixed:
- CVE-2019-12855: Fixed TLS certificate verification to protecting against MITM attacks (bsc#1138461).
- Record
SUSE-SU-2019:2212-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:2453-1 No score
Security update for python-Twisted
This update for python-Twisted fixes the following issues:
Security issue fixed:
- CVE-2019-12855: Fixed TLS certificate verification to protecting against MITM attacks (bsc#1138461).
- Record
SUSE-SU-2019:2453-1- Updated
- 2026-11-02
OSVUSN-4308-1 No score
twisted vulnerabilities
it was discovered that Twisted incorrectly validated or sanitized certain URIs or HTTP methods. A remote attacker could use this issue to inject invalid characters and possibly perform header injection attacks. (CVE-2019-12387)
It was discovered that Twisted incorrectly verified XMPP TLS certificates. A remote attacker could possibly use this issue to perform a machine-in-the-middle attack and obtain sensitive information. (CVE-2019-12855)
It was discovered that Twisted incorrectly handled HTTP/2 connections. A remote attacker could possibly use this issue to cause Twisted to hang or consume resources, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 19.10. (CVE-2019-9512, CVE-2019-9514, CVE-2019-9515)
Jake Miller and ZeddYu Lu discovered that Twisted incorrectly handled certain content-length headers. A remote attacker could possibly use this issue to perform HTTP request splitting attacks. (CVE-2020-10108, CVE-2020-10109)
- Record
USN-4308-1- Updated
- 2026-11-02
OSVUSN-4308-2 No score
twisted vulnerabilities
USN-4308-1 fixed several vulnerabilities in Twisted. This update provides the corresponding update for Ubuntu 14.04 ESM.
Original advisory details:
it was discovered that Twisted incorrectly validated or sanitized certain URIs or HTTP methods. A remote attacker could use this issue to inject invalid characters and possibly perform header injection attacks. (CVE-2019-12387)
It was discovered that Twisted incorrectly verified XMPP TLS certificates. A remote attacker could possibly use this issue to perform a machine-in-the-middle attack and obtain sensitive information. (CVE-2019-12855)
Jake Miller and ZeddYu Lu discovered that Twisted incorrectly handled certain content-length headers. A remote attacker could possibly use this issue to perform HTTP request splitting attacks. (CVE-2020-10108, CVE-2020-10109)
- Record
USN-4308-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
twistedPyPI |
before 19.7.0rc1 | 19.7.0rc1 |
python-twistedAzure Linux:2 |
before 22.2.0-1 | 22.2.0-1 |
twistedDebian:12 |
before 18.9.0-7 | 18.9.0-7 |
twistedDebian:13 |
before 18.9.0-7 | 18.9.0-7 |
twistedDebian:14 |
before 18.9.0-7 | 18.9.0-7 |
twistedPyPI |
before 19.7.0rc1, plus listed versions 1.0.11.0.31.0.41.0.51.0.6 Show 45 moreShow less1.0.71.1.01.1.11.2.010.0.010.1.010.2.011.0.011.1.012.0.012.1.012.2.012.3.013.0.013.1.013.2.014.0.014.0.114.0.215.0.015.1.015.2.015.2.115.3.015.4.015.5.016.0.016.1.016.1.116.2.016.3.016.3.116.3.216.4.016.4.116.5.016.5.0rc116.5.0rc216.6.016.6.0rc116.7.0rc116.7.0rc217.1.017.1.0rc117.5.0 |
19.7.0rc1 |
python-twistedMageia:7 From an advisory covering 2 CVEs |
before 19.2.1-1.1.mga7 | 19.2.1-1.1.mga7 |
twistedPyPI |
before 19.7.0rc1, plus listed versions 1.0.11.0.31.0.41.0.51.0.6 Show 45 moreShow less1.0.71.1.01.1.11.2.02.1.02.4.02.5.08.0.08.0.18.1.08.2.09.0.010.0.010.1.010.2.011.0.011.1.012.0.012.1.012.2.012.3.013.0.013.1.013.2.014.0.014.0.114.0.215.0.015.1.015.2.015.2.115.3.015.4.015.5.016.0.016.1.016.1.116.2.016.3.016.3.116.3.216.4.016.4.116.5.0rc116.5.0rc2 |
19.7.0rc1 |
python-TwistedSUSE:HPE Helion OpenStack 8 |
before 15.2.1-9.8.1 | 15.2.1-9.8.1 |
python-TwistedSUSE:OpenStack Cloud 7 |
before 15.2.1-9.8.1 | 15.2.1-9.8.1 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-TwistedSUSE:OpenStack Cloud 8 |
before 15.2.1-9.8.1 | 15.2.1-9.8.1 |
python-TwistedSUSE:OpenStack Cloud 9 |
before 15.2.1-9.8.1 | 15.2.1-9.8.1 |
python-TwistedSUSE:OpenStack Cloud Crowbar 8 |
before 15.2.1-9.8.1 | 15.2.1-9.8.1 |
python-TwistedSUSE:OpenStack Cloud Crowbar 9 |
before 15.2.1-9.8.1 | 15.2.1-9.8.1 |
python-TwistedSUSE:Linux Enterprise Module for Web and Scripting 12 |
before 15.2.1-9.8.1 | 15.2.1-9.8.1 |
python-TwistedSUSE:Enterprise Storage 4 |
before 15.2.1-9.8.1 | 15.2.1-9.8.1 |
python-TwistedSUSE:Enterprise Storage 5 |
before 15.2.1-9.8.1 | 15.2.1-9.8.1 |
twistedUbuntu:Pro:14.04:LTS |
before 13.2.0-1ubuntu1.2+esm1, plus listed versions 13.0.0-1ubuntu113.2.0-1ubuntu113.2.0-1ubuntu1.2 |
13.2.0-1ubuntu1.2+esm1 |
twistedUbuntu:16.04:LTS |
before 16.0.0-1ubuntu0.4, plus listed versions 15.2.1-1ubuntu215.5.0-115.5.0-215.5.0-2ubuntu115.5.0-4 Show 6 moreShow less16.0.0~pre1-116.0.0~pre1-1ubuntu116.0.0~pre1-2ubuntu116.0.0~pre1-316.0.0-116.0.0-1ubuntu0.2 |
16.0.0-1ubuntu0.4 |
twistedUbuntu:18.04:LTS |
before 17.9.0-2ubuntu0.1, plus listed versions 16.6.0-2ubuntu317.9.0-117.9.0-2 |
17.9.0-2ubuntu0.1 |
twistedUbuntu:16.04:LTS From an advisory covering 7 CVEs |
before 16.0.0-1ubuntu0.4, plus listed versions 15.2.1-1ubuntu215.5.0-115.5.0-215.5.0-2ubuntu115.5.0-4 Show 6 moreShow less16.0.0~pre1-116.0.0~pre1-1ubuntu116.0.0~pre1-2ubuntu116.0.0~pre1-316.0.0-116.0.0-1ubuntu0.2 |
16.0.0-1ubuntu0.4 |
twistedUbuntu:18.04:LTS From an advisory covering 7 CVEs |
before 17.9.0-2ubuntu0.1, plus listed versions 16.6.0-2ubuntu317.9.0-117.9.0-2 |
17.9.0-2ubuntu0.1 |
twistedUbuntu:Pro:14.04:LTS From an advisory covering 4 CVEs |
before 13.2.0-1ubuntu1.2+esm1, plus listed versions 13.0.0-1ubuntu113.2.0-1ubuntu113.2.0-1ubuntu1.2 |
13.2.0-1ubuntu1.2+esm1 |
python-TwistedopenSUSE:Leap 15.0 |
before 17.9.0-lp151.3.6.1 | 17.9.0-lp151.3.6.1 |
python-TwistedopenSUSE:Leap 15.1 |
before 17.9.0-lp151.3.6.1 | 17.9.0-lp151.3.6.1 |
python-TwistedSUSE:Package Hub 15 |
before 17.9.0-bp150.4.6.1 | 17.9.0-bp150.4.6.1 |
python-TwistedopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 21.7.0-3.2 | 21.7.0-3.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-12855 is a high vulnerability (CVSS 7.4) in Twisted, published June 16, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.81%, the 78th percentile. Fixed in twisted 19.7.0rc1.
References
twistedmatrix.com/trac/ticket/9561
github.com/twisted/twisted/pull/1147
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLTZDMFBNFSJMBXYJNGJHENJA4H2TSMZ
lists.opensuse.org/opensuse-security-announce/2019-09/msg00013.html
usn.ubuntu.com/4308-2
Show 31 moreShow less
oracle.com/security-alerts/cpuapr2020.html
nvd.nist.gov/vuln/detail/CVE-2019-12855
docs.bell-sw.com/security/cves/CVE-2019-12855
security-tracker.debian.org/tracker/CVE-2019-12855
advisories.mageia.org/MGASA-2019-0360.html
bugs.mageia.org/show_bug.cgi?id=25752
suse.com/support/update/announcement/2019/suse-su-20192212-1
bugzilla.suse.com/1138461
ubuntu.com/security/CVE-2019-12855
cve.org/CVERecord?id=CVE-2019-12855
Left out here: 42 versions. The JSON record has them.