websocket: default TLS config verifies wrong TLS certificate #259

New issue

Closed

opened 2022-02-11 16:44:48 +00:00 by SamWhited · 0 comments

SamWhited commented

2022-02-11 16:44:48 +00:00

Owner

A report has been filed about a potential security issue in the websocket package. The default TLS configuration that is constructed if no user TLS config is provided verifies the domain of the websocket connection endpoint discovered via DNS TXT lookups instead of the domain on the original JID, meaning that any attacker that can spoof DNS can point the TXT record at their own domain and it will validate successfully.

CVE ID: CVE-2022-24968
Affected versions: v0.18.0, v0.19.0, v0.20.0, v0.21.0
Patch: #260
Fixed in: v0.21.1
Report: https://mellium.im/cve/cve-2022-24968/

A report has been filed about a potential security issue in the `websocket` package. The default TLS configuration that is constructed if no user TLS config is provided verifies the domain of the websocket connection endpoint discovered via DNS TXT lookups instead of the domain on the original JID, meaning that any attacker that can spoof DNS can point the TXT record at their own domain and it will validate successfully. - **CVE ID:** [CVE-2022-24968](https://nvd.nist.gov/vuln/detail/CVE-2022-24968) - **Affected versions:** v0.18.0, v0.19.0, v0.20.0, v0.21.0 - **Patch:** #260 - **Fixed in:** v0.21.1 - **Report:** https://mellium.im/cve/cve-2022-24968/