Bug 1672965 (CVE-2019-1000021)

Summary:	CVE-2019-1000021 python-slixmpp: Improper acccess control in XEP-0223 plugin
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	casper, louiz
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	slixmpp 1.4.2	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:47:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1672967
Bug Blocks:

Description Dhananjay Arunesh 2019-02-06 10:51:09 UTC

slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains
an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage
of Private Data via PubSub) options profile, used for the configuration of
default access model that can result in all of the contacts of the victim can
see private data having been published to a PEP node. This attack appears to be
exploitable if the user of this library publishes any private data on PEP, the
node isn't configured to be private. This vulnerability appears to have been
fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in
slixmpp 1.4.2.

Upstream Issue:
https://xmpp.org/extensions/xep-0223.html#howitworks

Upstream patch:
https://lab.louiz.org/poezio/slixmpp/commit/7cd73b594e8122dddf847953fcfc85ab4d316416

Comment 1 Dhananjay Arunesh 2019-02-06 10:54:22 UTC

Created python-slixmpp tracking bugs for this issue:

Affects: fedora-all [bug 1672967]

Comment 2 Product Security DevOps Team 2019-06-10 10:47:24 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.