{"id":"CVE-2019-12855","aliases":["AZL-6818","BELL-CVE-2019-12855","DEBIAN-CVE-2019-12855","EUVD-2019-0147","GHSA-65rm-h285-5cc5","MGASA-2019-0360","PYSEC-2019-129","SUSE-SU-2019:2212-1","SUSE-SU-2019:2453-1","UBUNTU-CVE-2019-12855","USN-4308-1","USN-4308-2","openSUSE-SU-2019:2068-1","openSUSE-SU-2019:2110-1","openSUSE-SU-2024:11212-1"],"status":"published","title":"Improper Certificate Validation in Twisted","description":"In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.","severity":{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01809,"percentile":0.78758,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2019-06-16T11:11:43Z","modified":"2026-10-20T10:52:20Z","fixes":[{"ecosystem":"PyPI","package":"twisted","fixed_in":["19.7.0rc1"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"python-twisted","fixed_in":["22.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"twisted","fixed_in":["18.9.0-7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"twisted","fixed_in":["18.9.0-7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"twisted","fixed_in":["18.9.0-7"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-Twisted","fixed_in":["15.2.1-9.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"python-Twisted","fixed_in":["15.2.1-9.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"python-Twisted","fixed_in":["15.2.1-9.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Twisted","fixed_in":["15.2.1-9.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-Twisted","fixed_in":["15.2.1-9.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Twisted","fixed_in":["15.2.1-9.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"python-Twisted","fixed_in":["15.2.1-9.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 4","package":"python-Twisted","fixed_in":["15.2.1-9.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 5","package":"python-Twisted","fixed_in":["15.2.1-9.8.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"twisted","fixed_in":["13.2.0-1ubuntu1.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"twisted","fixed_in":["16.0.0-1ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"twisted","fixed_in":["17.9.0-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"python-Twisted","fixed_in":["17.9.0-lp151.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"python-Twisted","fixed_in":["17.9.0-lp151.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15","package":"python-Twisted","fixed_in":["17.9.0-bp150.4.6.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.7.0rc1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.9.0-7"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.9.0-7"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.9.0-7"}]}]},{"source":"osv","ecosystem":"PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.7.0rc1"}]}],"versions":["1.0.1","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.2.0","10.0.0","10.1.0","10.2.0","11.0.0","11.1.0","12.0.0","12.1.0","12.2.0","12.3.0","13.0.0","13.1.0","13.2.0","14.0.0","14.0.1","14.0.2","15.0.0","15.1.0","15.2.0","15.2.1","15.3.0","15.4.0","15.5.0","16.0.0","16.1.0","16.1.1","16.2.0","16.3.0","16.3.1","16.3.2","16.4.0","16.4.1","16.5.0","16.5.0rc1","16.5.0rc2","16.6.0","16.6.0rc1","16.7.0rc1","16.7.0rc2","17.1.0","17.1.0rc1","17.5.0","17.9.0","17.9.0rc1","18.4.0","18.4.0rc1","18.7.0","18.7.0rc1","18.7.0rc2","18.9.0","18.9.0rc1","19.2.0","19.2.0rc1","19.2.0rc2","19.2.1","2.1.0","2.4.0","2.5.0","8.0.0","8.0.1","8.1.0","8.2.0","9.0.0"]},{"source":"osv","ecosystem":"Mageia:7","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.2.1-1.1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.7.0rc1"}]}],"versions":["1.0.1","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.2.0","2.1.0","2.4.0","2.5.0","8.0.0","8.0.1","8.1.0","8.2.0","9.0.0","10.0.0","10.1.0","10.2.0","11.0.0","11.1.0","12.0.0","12.1.0","12.2.0","12.3.0","13.0.0","13.1.0","13.2.0","14.0.0","14.0.1","14.0.2","15.0.0","15.1.0","15.2.0","15.2.1","15.3.0","15.4.0","15.5.0","16.0.0","16.1.0","16.1.1","16.2.0","16.3.0","16.3.1","16.3.2","16.4.0","16.4.1","16.5.0rc1","16.5.0rc2","16.5.0","16.6.0rc1","16.6.0","16.7.0rc1","16.7.0rc2","17.1.0rc1","17.1.0","17.5.0","17.9.0rc1","17.9.0","18.4.0rc1","18.4.0","18.7.0rc1","18.7.0rc2","18.7.0","18.9.0rc1","18.9.0","19.2.0rc1","19.2.0rc2","19.2.0","19.2.1"]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.8.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.2.0-1ubuntu1.2+esm1"}]}],"versions":["13.0.0-1ubuntu1","13.2.0-1ubuntu1","13.2.0-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.0.0-1ubuntu0.4"}]}],"versions":["15.2.1-1ubuntu2","15.5.0-1","15.5.0-2","15.5.0-2ubuntu1","15.5.0-4","16.0.0~pre1-1","16.0.0~pre1-1ubuntu1","16.0.0~pre1-2ubuntu1","16.0.0~pre1-3","16.0.0-1","16.0.0-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.9.0-2ubuntu0.1"}]}],"versions":["16.6.0-2ubuntu3","17.9.0-1","17.9.0-2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.0.0-1ubuntu0.4"}]}],"versions":["15.2.1-1ubuntu2","15.5.0-1","15.5.0-2","15.5.0-2ubuntu1","15.5.0-4","16.0.0~pre1-1","16.0.0~pre1-1ubuntu1","16.0.0~pre1-2ubuntu1","16.0.0~pre1-3","16.0.0-1","16.0.0-1ubuntu0.2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.9.0-2ubuntu0.1"}]}],"versions":["16.6.0-2ubuntu3","17.9.0-1","17.9.0-2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.2.0-1ubuntu1.2+esm1"}]}],"versions":["13.0.0-1ubuntu1","13.2.0-1ubuntu1","13.2.0-1ubuntu1.2"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.9.0-lp151.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.9.0-lp151.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.9.0-bp150.4.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.7.0-3.2"}]}],"bundled":3}],"products":[{"vendor":"twisted","product":"twisted"}],"references":[{"url":"https://twistedmatrix.com/trac/ticket/9561","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/twisted/twisted/pull/1147","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLTZDMFBNFSJMBXYJNGJHENJA4H2TSMZ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00013.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00028.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4308-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4308-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12855","tags":["web","advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2019-129.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PLTZDMFBNFSJMBXYJNGJHENJA4H2TSMZ","tags":["web"]},{"url":"https://usn.ubuntu.com/4308-1","tags":["web"]},{"url":"https://usn.ubuntu.com/4308-2","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLTZDMFBNFSJMBXYJNGJHENJA4H2TSMZ","tags":["web"]},{"url":"https://github.com/advisories/GHSA-65rm-h285-5cc5","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-12855","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-12855","tags":["advisory"]},{"url":"https://github.com/twisted/twisted","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2019-0360.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25752","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2019-07/msg00089.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2019-09/msg00028.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PLTZDMFBNFSJMBXYJNGJHENJA4H2TSMZ/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192212-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1138461","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12855","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192453-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-12855","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4308-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4308-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-12855","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9512","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9514","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9515","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12387","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-10108","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-10109","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SH7BNY5HAZBZT6SOYNJXKFXH7LVVFMDU/#SH7BNY5HAZBZT6SOYNJXKFXH7LVVFMDU","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RDX7X2CSLBDTL5E77Q6EU2VMZIUQO42C/#RDX7X2CSLBDTL5E77Q6EU2VMZIUQO42C","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9512","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-12855","description":"In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.","status":"published","published":"2019-06-16T11:11:43Z","modified":"2024-08-04T23:32:55.45Z","updated_at":"2026-11-02T14:20:23.697579Z"}],"euvd":[{"id":"EUVD-2019-0147","description":"In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.","status":"published","published":"2019-06-16T11:11:43Z","modified":"2024-08-04T23:32:55Z","updated_at":"2026-11-03T02:40:44.884887Z"}],"ghsa":[{"id":"GHSA-65rm-h285-5cc5","title":"Improper Certificate Validation in Twisted","description":"In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.","status":"published","published":"2019-08-16T14:02:35Z","modified":"2024-11-25T18:34:28Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:38:23.575854Z"}],"nvd":[{"id":"CVE-2019-12855","description":"In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.","status":"published","published":"2019-06-16T12:29:00.227Z","modified":"2026-06-17T02:15:37.527Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:05:16.285679Z"}],"osv":[{"id":"AZL-6818","title":"CVE-2019-12855 affecting package python-twisted for versions less than 22.2.0-1","description":"In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.","status":"published","published":"2019-06-16T12:29:00Z","modified":"2026-04-21T04:38:20.768665Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:08.630357Z"},{"id":"BELL-CVE-2019-12855","title":"CVE-2019-12855 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:26.937339Z","modified":"2026-01-26T09:46:57.567177Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-12855","description":"In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.","status":"published","published":"2019-06-16T12:29:00.227Z","modified":"2026-10-20T10:52:20.552750293Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:10.718934Z"},{"id":"DEBIAN-CVE-2019-12855","description":"In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.","status":"published","published":"2019-06-16T12:29:00.227Z","modified":"2026-09-21T07:00:57.286578387Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"GHSA-65rm-h285-5cc5","title":"Improper Certificate Validation in Twisted","description":"In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.","status":"published","published":"2019-08-16T14:02:35Z","modified":"2024-12-06T05:26:31.559414Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"UBUNTU-CVE-2019-12855","description":"In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.","status":"published","published":"2019-06-16T12:29:00Z","modified":"2026-02-04T03:04:14.139724Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"MGASA-2019-0360","title":"Updated python-twisted packages fix security vulnerabilities","description":"Updated python-twisted packages fix security vulnerabilities:\n\nImproper sanitization of URIs or HTTP which could allow attackers to\nperform CRLF attacks (CVE-2019-12387).\n\nIn words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP\nsupport did not verify certificates when used with TLS, allowing an\nattacker to MITM connections (CVE-2019-12855).\n","status":"published","published":"2019-12-06T14:15:42Z","modified":"2026-04-16T04:43:02.993199106Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2019:2068-1","title":"Security update for python-Twisted","description":"This update for python-Twisted fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-12855: Fixed TLS certificate verification to protecting against MITM attacks (bsc#1138461).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-09-05T08:23:19Z","modified":"2026-02-04T04:17:07.055568Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2110-1","title":"Security update for python-Twisted","description":"This update for python-Twisted fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-12855: Fixed TLS certificate verification to protecting against MITM attacks (bsc#1138461).\n\nThis update was imported from the SUSE:SLE-15:Update update project.\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-09-10T14:20:42Z","modified":"2026-02-04T04:00:28.30786Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11212-1","title":"python-Twisted-doc-21.7.0-3.2 on GA media","description":"These are all security issues fixed in the python-Twisted-doc-21.7.0-3.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:08:12.042636Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"PYSEC-2019-129","description":"In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.","status":"published","published":"2019-06-16T12:29:00Z","modified":"2023-11-08T04:01:06.614992Z","updated_at":"2026-11-02T15:52:52.192131Z"},{"id":"SUSE-SU-2019:2212-1","title":"Security update for python-Twisted","description":"This update for python-Twisted fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-12855: Fixed TLS certificate verification to protecting against MITM attacks (bsc#1138461).\n","status":"published","published":"2019-08-23T12:47:02Z","modified":"2026-02-04T04:02:44.404596Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2453-1","title":"Security update for python-Twisted","description":"This update for python-Twisted fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-12855: Fixed TLS certificate verification to protecting against MITM attacks (bsc#1138461).\n","status":"published","published":"2019-09-24T14:46:12Z","modified":"2025-05-02T04:08:45.394277Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-4308-1","title":"twisted vulnerabilities","description":"it was discovered that Twisted incorrectly validated or sanitized certain\nURIs or HTTP methods. A remote attacker could use this issue to inject\ninvalid characters and possibly perform header injection attacks.\n(CVE-2019-12387)\n\nIt was discovered that Twisted incorrectly verified XMPP TLS certificates.\nA remote attacker could possibly use this issue to perform a\nmachine-in-the-middle attack and obtain sensitive information. (CVE-2019-12855)\n\nIt was discovered that Twisted incorrectly handled HTTP/2 connections. A\nremote attacker could possibly use this issue to cause Twisted to hang or\nconsume resources, leading to a denial of service. This issue only affected\nUbuntu 18.04 LTS and Ubuntu 19.10. (CVE-2019-9512, CVE-2019-9514,\nCVE-2019-9515)\n\nJake Miller and ZeddYu Lu discovered that Twisted incorrectly handled\ncertain content-length headers. A remote attacker could possibly use this\nissue to perform HTTP request splitting attacks. (CVE-2020-10108,\nCVE-2020-10109)\n","status":"published","published":"2020-03-19T17:18:55Z","modified":"2026-04-27T15:48:43.343050534Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4308-2","title":"twisted vulnerabilities","description":"USN-4308-1 fixed several vulnerabilities in Twisted. This update provides\nthe corresponding update for Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n it was discovered that Twisted incorrectly validated or sanitized certain\n URIs or HTTP methods. A remote attacker could use this issue to inject\n invalid characters and possibly perform header injection attacks.\n (CVE-2019-12387)\n\n It was discovered that Twisted incorrectly verified XMPP TLS certificates.\n A remote attacker could possibly use this issue to perform a\n machine-in-the-middle attack and obtain sensitive information. (CVE-2019-12855)\n\n Jake Miller and ZeddYu Lu discovered that Twisted incorrectly handled\n certain content-length headers. A remote attacker could possibly use this\n issue to perform HTTP request splitting attacks. (CVE-2020-10108,\n CVE-2020-10109)\n","status":"published","published":"2020-03-30T12:00:51Z","modified":"2026-02-10T04:41:48Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}