| id: GO-2022-0370 |
| modules: |
| - module: mellium.im/xmpp |
| versions: |
| - introduced: 0.18.0 |
| fixed: 0.21.1 |
| vulnerable_at: 0.21.0 |
| packages: |
| - package: mellium.im/xmpp/websocket |
| symbols: |
| - Dialer.config |
| derived_symbols: |
| - Dial |
| - DialDirect |
| - DialSession |
| - Dialer.Dial |
| - Dialer.DialDirect |
| - NewClient |
| summary: |- |
| Man-in-the-middle attack due to improper validation of certificate in |
| mellium.im/xmpp |
| description: |- |
| Websocket client connections are vulnerable to man-in-the-middle attacks via DNS |
| spoofing. |
| |
| When looking up a WSS endpoint using a DNS TXT record, the server TLS |
| certificate is incorrectly validated using the name of the server returned by |
| the TXT record request, not the name of the the server being connected to. This |
| permits any attacker that can spoof a DNS record to redirect the user to a |
| server of their choosing. |
| |
| Providing a *tls.Config with a ServerName field set to the correct destination |
| hostname will avoid this issue. |
| published: 2022-07-29T20:00:14Z |
| cves: |
| - CVE-2022-24968 |
| ghsas: |
| - GHSA-h289-x5wc-xcv8 |
| - GHSA-m658-p24x-p74r |
| references: |
| - advisory: https://mellium.im/cve/cve-2022-24968/ |
| - fix: https://github.com/mellium/xmpp/pull/260 |
| - fix: https://github.com/mellium/xmpp/commit/0d92aa486da69b71f2f4a30e62aa722c711b98ac |
| - report: https://mellium.im/issue/259 |
