{"id":"CVE-2022-45197","aliases":["DEBIAN-CVE-2022-45197","EUVD-2022-0279","GHSA-q6cq-m9gm-6q2f","MGASA-2022-0469","PYSEC-2022-43013","UBUNTU-CVE-2022-45197","openSUSE-SU-2022:10241-1","openSUSE-SU-2022:10242-1","openSUSE-SU-2024:12551-1","openSUSE-SU-2025:14628-1"],"status":"published","title":"Slixmpp lacks SSL Certificate hostname validation in XMLStream","description":"Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00514,"percentile":0.44232,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2022-12-10T15:01:14Z","modified":"2026-10-15T08:03:06Z","fixes":[{"ecosystem":"PyPI","package":"slixmpp","fixed_in":["1.8.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"slixmpp","fixed_in":["1.8.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"slixmpp","fixed_in":["1.8.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"slixmpp","fixed_in":["1.8.3-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"python-slixmpp","fixed_in":["1.8.3-1.mga8"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP3","package":"python-slixmpp","fixed_in":["1.4.2-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"python-slixmpp","fixed_in":["1.4.2-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP4","package":"python-slixmpp","fixed_in":["1.4.2-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"python-slixmpp","fixed_in":["1.4.2-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-slixmpp","fixed_in":["1.8.6-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"slixmpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"slixmpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"slixmpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"slixmpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"slixmpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3"}]}],"versions":["1.0","1.0.post1","1.0.post2","1.0.post3","1.0.post4","1.0.post5","1.1","1.2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.4.post1","1.3.0","1.4.0","1.4.1","1.4.2","1.5.0","1.5.1","1.5.2","1.6.0","1.7.0","1.7.1","1.8.0","1.8.0.1","1.8.1","1.8.2"]},{"source":"osv","ecosystem":"Mageia:8","package":"python-slixmpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1.mga8"}]}]},{"source":"osv","ecosystem":"PyPI","package":"slixmpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3"}]}],"versions":["1.0","1.0.post1","1.0.post2","1.0.post3","1.0.post4","1.0.post5","1.1","1.2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.4.post1","1.3.0","1.4.0","1.4.1","1.4.2","1.5.0","1.5.1","1.5.2","1.6.0","1.7.0","1.7.1","1.8.0","1.8.0.1","1.8.1","1.8.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"slixmpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.2-1.1build2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"slixmpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.2-1","1.4.2-1build1","1.4.2-1build2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"slixmpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.0-2","1.7.0-2ubuntu1","1.7.1-1","1.7.1-1build1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"python-slixmpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"python-slixmpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"python-slixmpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"python-slixmpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-slixmpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.6-1.1"}]}]}],"products":[{"vendor":"slixmpp_project","product":"slixmpp"}],"references":[{"url":"https://github.com/poezio/slixmpp/tags","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/poezio/slixmpp/commits/master/slixmpp/xmlstream/xmlstream.py","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://lab.louiz.org/poezio/slixmpp/-/commits/master","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://lab.louiz.org/poezio/slixmpp/-/commit/b60b1b985db928532f97c4f61d6fbc801f0aa7fa","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://security.gentoo.org/glsa/202305-07","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45197","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/slixmpp/PYSEC-2022-43013.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q6cq-m9gm-6q2f","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-45197","tags":["advisory"]},{"url":"https://github.com/poezio/slixmpp","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2022-0469.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31200","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/RDCGUJ5VBYUCDAXSHYA5NX2THU2RYIXE/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-45197","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45197","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZTWQRGQUNC6IRUHCNF7HC3ZV3BQUI2TJ/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1205433","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45197","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HEPLQSEZKJOMWR57SHWYRWJJTW2H32LD/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7YJ5Q22GRZVKZS3MVHYJQ4AMPXGMIIP7/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-45197","description":"Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.","status":"published","published":"2022-12-25T00:00:00Z","modified":"2025-04-14T18:20:25.935Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:34:31.519788Z"}],"euvd":[{"id":"EUVD-2022-0279","description":"Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.","status":"published","published":"2022-12-25T00:00:00Z","modified":"2025-04-14T18:20:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:52:33.06705Z"}],"ghsa":[{"id":"GHSA-q6cq-m9gm-6q2f","title":"Slixmpp lacks SSL Certificate hostname validation in XMLStream","description":"Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.","status":"published","published":"2022-12-25T06:30:20Z","modified":"2024-10-23T18:34:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:38:13.09489Z"}],"nvd":[{"id":"CVE-2022-45197","description":"Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.","status":"published","published":"2022-12-25T05:15:11.17Z","modified":"2026-06-17T05:09:37.61Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:07:34.388163Z"}],"osv":[{"id":"CVE-2022-45197","description":"Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.","status":"published","published":"2022-12-25T05:15:11.17Z","modified":"2026-04-16T04:31:22.788952054Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:27.481647Z"},{"id":"DEBIAN-CVE-2022-45197","description":"Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.","status":"published","published":"2022-12-25T05:15:11.17Z","modified":"2026-11-03T08:04:12.003179742Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T08:23:07.763774Z"},{"id":"GHSA-q6cq-m9gm-6q2f","title":"Slixmpp lacks SSL Certificate hostname validation in XMLStream","description":"Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.","status":"published","published":"2022-12-25T06:30:20Z","modified":"2024-10-23T18:41:21.698781Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"UBUNTU-CVE-2022-45197","description":"Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.","status":"published","published":"2022-12-25T05:15:00Z","modified":"2025-10-24T04:53:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"MGASA-2022-0469","title":"Updated python-slixmpp packages fix security vulnerability","description":"Fixes missing certificate hostname validation\n","status":"published","published":"2022-12-17T18:48:08Z","modified":"2026-04-16T04:42:01.312350514Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2022:10241-1","title":"Security update for python-slixmpp","description":"This update for python-slixmpp fixes the following issues:\n\n- CVE-2022-45197: Fixed certificate hostname validation (boo#1205433)\n","status":"published","published":"2022-12-10T15:01:14Z","modified":"2026-02-04T02:58:09.055272Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:10242-1","title":"Security update for python-slixmpp","description":"This update for python-slixmpp fixes the following issues:\n\n- CVE-2022-45197: Fixed certificate hostname validation (boo#1205433)\n","status":"published","published":"2022-12-10T23:01:50Z","modified":"2026-02-04T03:09:33.579405Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12551-1","title":"python310-slixmpp-1.8.3-1.1 on GA media","description":"These are all security issues fixed in the python310-slixmpp-1.8.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:23:35.896064Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2025:14628-1","title":"python311-slixmpp-1.8.6-1.1 on GA media","description":"These are all security issues fixed in the python311-slixmpp-1.8.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-09T00:00:00Z","modified":"2026-02-04T03:23:21.123021Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"PYSEC-2022-43013","description":"Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.","status":"published","published":"2022-12-25T05:15:00Z","modified":"2026-06-10T17:02:41.537424496Z","updated_at":"2026-11-02T15:52:53.449407Z"}]}}