Every CVE Search/ Get API key

CVE-2022-45197

Slixmpp lacks SSL Certificate hostname validation in XMLStream

7.5 HighFix available

CVE-2022-45197 is a high vulnerability (CVSS 7.5) in Slixmpp Project Slixmpp, published December 10, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. Fixed in slixmpp 1.8.3.

Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.51%Down 0.4 points since Dec 25, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.

Record
CVE-2022-45197
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
CVE List 7.5

Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.

Record
CVE-2022-45197
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
EUVDEUVD-2022-0279 7.5

Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.

Record
EUVD-2022-0279
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-q6cq-m9gm-6q2f 7.5

Slixmpp lacks SSL Certificate hostname validation in XMLStream

Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.

Record
GHSA-q6cq-m9gm-6q2f
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
OSV 7.5

Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.

Record
CVE-2022-45197
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2022-45197 7.5

Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.

Record
DEBIAN-CVE-2022-45197
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
Show 8 moreShow less
OSVGHSA-q6cq-m9gm-6q2f 7.5

Slixmpp lacks SSL Certificate hostname validation in XMLStream

Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.

Record
GHSA-q6cq-m9gm-6q2f
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
OSVUBUNTU-CVE-2022-45197 7.5

Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.

Record
UBUNTU-CVE-2022-45197
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVMGASA-2022-0469 No score

Updated python-slixmpp packages fix security vulnerability

Fixes missing certificate hostname validation

Record
MGASA-2022-0469
Updated
2026-11-02
OSVopenSUSE-SU-2022:10241-1 No score

Security update for python-slixmpp

This update for python-slixmpp fixes the following issues:

  • CVE-2022-45197: Fixed certificate hostname validation (boo#1205433)
Record
openSUSE-SU-2022:10241-1
Updated
2026-11-02
OSVopenSUSE-SU-2022:10242-1 No score

Security update for python-slixmpp

This update for python-slixmpp fixes the following issues:

  • CVE-2022-45197: Fixed certificate hostname validation (boo#1205433)
Record
openSUSE-SU-2022:10242-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12551-1 No score

python310-slixmpp-1.8.3-1.1 on GA media

These are all security issues fixed in the python310-slixmpp-1.8.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12551-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:14628-1 No score

python311-slixmpp-1.8.6-1.1 on GA media

These are all security issues fixed in the python311-slixmpp-1.8.6-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14628-1
Updated
2026-11-02
OSVPYSEC-2022-43013 No score

Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.

Record
PYSEC-2022-43013
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
slixmpp
PyPI
 before 1.8.3
1.8.3
slixmpp
Debian:12
 before 1.8.3-1
1.8.3-1
slixmpp
Debian:13
 before 1.8.3-1
1.8.3-1
slixmpp
Debian:14
 before 1.8.3-1
1.8.3-1
slixmpp
PyPI
 before 1.8.3, plus listed versions
1.01.0.post11.0.post21.0.post31.0.post4
Show 22 moreShow less
1.0.post51.11.21.2.11.2.21.2.31.2.41.2.4.post11.3.01.4.01.4.11.4.21.5.01.5.11.5.21.6.01.7.01.7.11.8.01.8.0.11.8.11.8.2
1.8.3
python-slixmpp
Mageia:8
 before 1.8.3-1.mga8
1.8.3-1.mga8
slixmpp
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.2.2-1.1build2
 None known
slixmpp
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.4.2-11.4.2-1build11.4.2-1build2
 None known
slixmpp
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.7.0-21.7.0-2ubuntu11.7.1-11.7.1-1build1
 None known
python-slixmpp
SUSE:Package Hub 15 SP3
 before 1.4.2-bp153.2.3.1
1.4.2-bp153.2.3.1
Show 4 moreShow less
Affected packages
PackageAffectedFixed
python-slixmpp
openSUSE:Leap 15.3
 before 1.4.2-bp153.2.3.1
1.4.2-bp153.2.3.1
python-slixmpp
SUSE:Package Hub 15 SP4
 before 1.4.2-bp154.2.3.1
1.4.2-bp154.2.3.1
python-slixmpp
openSUSE:Leap 15.4
 before 1.4.2-bp154.2.3.1
1.4.2-bp154.2.3.1
python-slixmpp
openSUSE:Tumbleweed
 before 1.8.6-1.1
1.8.6-1.1

History

History
WhenChangedSources
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open