CVE-2022-24968
Medium
Description
In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail. This occurs because the wrong host name is selected during this verification.
SeverityMedium
CVSS5.9
Exploit probability—
ProductMellium Xmpp
PublishedFeb 11, 2022
First seenFeb 11, 2022
How to fix
Update
- mellium xmpp0.21.1 or later
- mellium.im/xmpp0.21.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mellium xmpp | 0.18.0 ≤ v < 0.21.1 | 0.21.1 |
| mellium.im/xmppGo | 0.18.0 ≤ v < 0.21.1 | 0.21.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.