In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail. This occurs because the wrong host name is selected during this verification.
Metrics
Affected Vendors & Products
References
Link | Providers |
---|---|
https://mellium.im/cve/cve-2022-24968/ | |
https://mellium.im/xmpp/ |
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2022-02-11T18:16:54
Updated: 2024-08-03T04:29:01.535Z
Reserved: 2022-02-11T00:00:00
Link: CVE-2022-24968
Vulnrichment
No data.
NVD
Status : Modified
Published: 2022-02-11T22:15:07.887
Modified: 2024-11-21T06:51:28.563
Link: CVE-2022-24968
Redhat
No data.