CVE-2019-12855

Name of the Vulnerable Software and Affected Versions: Twisted versions through 19.2.1

Description: The issue is related to the XMPP support in the words.protocols.jabber.xmlstream module of the Twisted network framework, which did not verify certificates when used with TLS. This allows an attacker to perform a man-in-the-middle (MITM) attack on connections. The vulnerability can be exploited by a remote attacker to intercept and manipulate data.

Recommendations: For Twisted versions through 19.2.1, update to a version that verifies certificates when using TLS to prevent MITM attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.