-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| slixmpp | pip | < 1.8.3 | 1.8.3 |
Miggo AIRoot Cause AnalysisThe vulnerability explicitly states that SSL certificate hostname validation was missing in XMLStream. The XMLStream component handles connection logic, and TLS setup would occur in a method like _start_tls. The CWE-295 (Improper Certificate Validation) and the advisory's focus on XMLStream strongly indicate the TLS initialization function lacked check_hostname=True in SSL context configuration or equivalent validation. The first patched version (1.8.3) likely added this validation in the TLS setup routine of XMLStream.
Ongoing coverage of React2Shell