CVE-2022-45197

Vulnerability

Description

CVE-2022-45197 is a security flaw in Slixmpp, an XMPP library for Python, affecting versions prior to 1.8.3. The vulnerability stems from the library's failure to validate SSL/TLS certificate hostnames in the XMLStream class [1]. This means that when a Slixmpp client establishes an encrypted connection to an XMPP server, it does not check whether the certificate presented actually matches the hostname of the server being contacted.

Attack

Vector

An attacker with a privileged network position (such as on a shared Wi-Fi network or within an ISP) can perform a man-in-the-middle (MITM) attack. By intercepting the TLS handshake and presenting a valid certificate for a different domain, the attacker can successfully impersonate any XMPP server to the Slixmpp client. No authentication bypass is needed beyond network interception; the client's missing hostname check means it will trust the fraudulent certificate [1][4].

Impact

Successful exploitation allows the attacker to decrypt, read, and modify all XMPP traffic between the client and the intended server. This includes direct messages, presence information, and roster data. The attack completely undermines the confidentiality and integrity of communications, enabling credential theft, message forgery, and session hijacking [1][4].

Mitigation

The vulnerability is fixed in Slixmpp version 1.8.3 [1][2]. Users and developers should upgrade to this release or later. As of the advisory publication, no workarounds have been provided, and users on older versions are advised to update immediately. The flaw has been recorded in the PyPA advisory database (PYSEC-2022-43013) [4].