CVE-2019-12855

Vulnerability

The vulnerability exists in the words.protocols.jabber.xmlstream module of Twisted through version 19.2.1. When XMPP connections use TLS, the certificate verification is not performed, meaning the client or server does not validate the identity of the peer. This breaks the security guarantees of TLS, as any certificate (including self-signed or malicious ones) is accepted without validation [1][2].

Exploitation

An attacker with network access to the communication link can perform a machine-in-the-middle (MITM) attack. By intercepting the TLS handshake and presenting a forged certificate, the attacker can establish separate encrypted sessions with both endpoints. No authentication is required beyond network position, and the attack is transparent to the users of the XMPP service [2][3].

Impact

Successful exploitation allows the attacker to read, modify, or inject messages in the XMPP stream. This can lead to disclosure of sensitive information, impersonation, or further compromise of systems relying on XMPP communications [2].

Mitigation

The issue has been fixed in later versions of Twisted. Ubuntu has released security updates (USN-4308-1 and USN-4308-2) addressing this vulnerability for affected releases [2][3]. Users should upgrade to a patched version of Twisted to restore proper TLS certificate verification.