CVE-2019-1000021
slixmpp Incorrect Access Control
slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all of the contacts of the victim can see private data having been published to a PEP node. This attack appears to be exploitable if the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability appears to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in slixmpp 1.4.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all of the contacts of the victim can see private data having been published to a PEP node. This attack appears to be exploitable if the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability appears to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in slixmpp 1.4.2.
- Record
CVE-2019-1000021- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all of the contacts of the victim can see private data having been published to a PEP node. This attack appears to be exploitable if the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability appears to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in slixmpp 1.4.2.
- Record
CVE-2019-1000021- Updated
- 2026-11-02
EUVDEUVD-2019-0130 No score
slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all of the contacts of the victim can see private data having been published to a PEP node. This attack appears to be exploitable if the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability appears to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in slixmpp 1.4.2.
- Record
EUVD-2019-0130- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4g62-mfwx-4q48
slixmpp Incorrect Access Control
slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all of the contacts of the victim can see private data having been published to a PEP node. This attack appears to be exploitable if the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability appears to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in slixmpp 1.4.2.
- Record
GHSA-4g62-mfwx-4q48- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all of the contacts of the victim can see private data having been published to a PEP node. This attack appears to be exploitable if the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability appears to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in slixmpp 1.4.2.
- Record
CVE-2019-1000021- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-1000021
slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all of the contacts of the victim can see private data having been published to a PEP node. This attack appears to be exploitable if the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability appears to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in slixmpp 1.4.2.
- Record
DEBIAN-CVE-2019-1000021- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 8 moreShow less
OSVGHSA-4g62-mfwx-4q48
slixmpp Incorrect Access Control
slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all of the contacts of the victim can see private data having been published to a PEP node. This attack appears to be exploitable if the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability appears to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in slixmpp 1.4.2.
- Record
GHSA-4g62-mfwx-4q48- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-1000021
slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all of the contacts of the victim can see private data having been published to a PEP node. This attack appears to be exploitable if the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability appears to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in slixmpp 1.4.2.
- Record
UBUNTU-CVE-2019-1000021- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2019:0163-1 No score
Security update for python-slixmpp
This update for python-slixmpp fixes the following issue:
Security issue fixed:
- CVE-2019-1000021: Fixed incorrect Access Control vulnerability in XEP-0223 plugin (bsc#1124322)
- Record
openSUSE-SU-2019:0163-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:0169-1 No score
Security update for python-slixmpp
This update for python-slixmpp fixes the following issue:
Security issue fixed:
- CVE-2019-1000021: Fixed incorrect Access Control vulnerability in XEP-0223 plugin (bsc#1124322)
This update was imported from the openSUSE:Leap:15.0:Update update project.
- Record
openSUSE-SU-2019:0169-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11274-1 No score
python36-slixmpp-1.5.2-1.9 on GA media
These are all security issues fixed in the python36-slixmpp-1.5.2-1.9 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11274-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14165-1 No score
python310-slixmpp-1.8.5-1.2 on GA media
These are all security issues fixed in the python310-slixmpp-1.8.5-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14165-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11272-1 No score
python313-slixmpp-1.16.0-2.1 on GA media
These are all security issues fixed in the python313-slixmpp-1.16.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11272-1- Updated
- 2026-11-02
OSVPYSEC-2019-121 No score
slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all of the contacts of the victim can see private data having been published to a PEP node. This attack appears to be exploitable if the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability appears to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in slixmpp 1.4.2.
- Record
PYSEC-2019-121- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
slixmppPyPI |
before 1.4.2 | 1.4.2 |
slixmppDebian:12 |
before 1.4.2-1 | 1.4.2-1 |
slixmppDebian:13 |
before 1.4.2-1 | 1.4.2-1 |
slixmppDebian:14 |
before 1.4.2-1 | 1.4.2-1 |
slixmppPyPI |
before 1.4.2, plus listed versions 1.01.0.post11.0.post21.0.post31.0.post4 Show 11 moreShow less1.0.post51.11.21.2.11.2.21.2.31.2.41.2.4.post11.3.01.4.01.4.1 |
1.4.2 |
slixmppUbuntu:18.04:LTS |
All versions, plus listed versions 1.2.2-1.1build2 |
None known |
slixmppUbuntu:20.04:LTS |
before 1.4.2-1 | 1.4.2-1 |
python-slixmppSUSE:Package Hub 15 |
before 1.3.0-bp150.3.3.1 | 1.3.0-bp150.3.3.1 |
python-slixmppopenSUSE:Tumbleweed |
before 1.8.5-1.2 | 1.8.5-1.2 |
python-slixmppopenSUSE:Tumbleweed |
before 1.16.0-2.1 | 1.16.0-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-1000021 is a high vulnerability (CVSS 7.5) in Slixmpp Project Slixmpp, published February 4, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.28%, the 83rd percentile. Fixed in slixmpp 1.4.2.
References
lab.louiz.org/poezio/slixmpp/commit/7cd73b594e8122dddf847953fcfc85ab4d316416
xmpp.org/extensions/xep-0223.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GKBXN7EAAR7ENEZUBKV6C6MP6QBXYTWT
nvd.nist.gov/vuln/detail/CVE-2019-1000021
github.com/poezio/slixmpp/commit/7cd73b594e8122dddf847953fcfc85ab4d316416
Show 13 moreShow less
security-tracker.debian.org/tracker/CVE-2019-1000021
ubuntu.com/security/CVE-2019-1000021
cve.org/CVERecord?id=CVE-2019-1000021
lists.opensuse.org/archives/list/[email protected]/thread/W7P3GHNLBJCIJZH25GNB7WHAOXB54LRZ
bugzilla.suse.com/1124322
suse.com/security/cve/CVE-2019-1000021