CVE catalog

CVE-2019-12855

twisted affected and fixed versions

[CVE catalog]

In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.

Severity
High · CVSS 7.4CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
1.81% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixietwisted18.9.0-7FixedDistribution-reported fixed boundary[CVE-2019-12855]
Debiantrixietwisted24.11.0-1Fixed[CVE-2019-12855]
Debiansidtwisted18.9.0-7FixedDistribution-reported fixed boundary[CVE-2019-12855]
Debiansidtwisted26.4.0-6Fixed[CVE-2019-12855]
Debianforkytwisted18.9.0-7FixedDistribution-reported fixed boundary[CVE-2019-12855]
Debianforkytwisted26.4.0-6Fixed[CVE-2019-12855]
Debianbookworm-securitytwisted22.4.0-4+deb12u1Fixed[CVE-2019-12855]
Debianbookwormtwisted18.9.0-7FixedDistribution-reported fixed boundary[CVE-2019-12855]
Debianbookwormtwisted22.4.0-4+deb12u1Fixed[CVE-2019-12855]

Showing 9 fix observations. All 41 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debianbookwormtwisted18.9.0-7FixedDistribution-reported fixed boundary[CVE-2019-12855]
Debianbookwormtwisted22.4.0-4+deb12u1Fixed[CVE-2019-12855]
Debianbookworm-securitytwisted22.4.0-4+deb12u1Fixed[CVE-2019-12855]
Debianforkytwisted18.9.0-7FixedDistribution-reported fixed boundary[CVE-2019-12855]
Debianforkytwisted26.4.0-6Fixed[CVE-2019-12855]
Debiansidtwisted18.9.0-7FixedDistribution-reported fixed boundary[CVE-2019-12855]
Debiansidtwisted26.4.0-6Fixed[CVE-2019-12855]
Debiantrixietwisted18.9.0-7FixedDistribution-reported fixed boundary[CVE-2019-12855]
Debiantrixietwisted24.11.0-1Fixed[CVE-2019-12855]
Opensuseleap 15.0python-Twisted17.9.0-lp151.3.6.1UnknownSource applicability is not established[OPENSUSE-SU-2019:2068-1]
Opensuseleap 15.1python-Twisted17.9.0-lp151.3.6.1UnknownSource applicability is not established[OPENSUSE-SU-2019:2068-1]
Suseenterprise storage 4python-Twisted15.2.1-9.8.1UnknownSource applicability is not established[SUSE-SU-2019:2453-1]
Suseenterprise storage 5python-Twisted15.2.1-9.8.1UnknownSource applicability is not established[SUSE-SU-2019:2453-1]
Susehpe helion openstack 8python-Twisted15.2.1-9.8.1UnknownSource applicability is not established[SUSE-SU-2019:2453-1]
Suselinux enterprise module for web and scripting 12python-Twisted15.2.1-9.8.1UnknownSource applicability is not established[SUSE-SU-2019:2453-1]
Suseopenstack cloud 7python-Twisted15.2.1-9.8.1UnknownSource applicability is not established[SUSE-SU-2019:2453-1]
Suseopenstack cloud 8python-Twisted15.2.1-9.8.1UnknownSource applicability is not established[SUSE-SU-2019:2453-1]
Suseopenstack cloud 9python-Twisted15.2.1-9.8.1UnknownSource applicability is not established[SUSE-SU-2019:2453-1]
Suseopenstack cloud crowbar 8python-Twisted15.2.1-9.8.1UnknownSource applicability is not established[SUSE-SU-2019:2453-1]
Suseopenstack cloud crowbar 9python-Twisted15.2.1-9.8.1UnknownSource applicability is not established[SUSE-SU-2019:2453-1]
Susepackage hub 15python-Twisted17.9.0-bp150.4.6.1UnknownSource applicability is not established[OPENSUSE-SU-2019:2110-1]
Ubuntu16.04twisted15.2.1-1ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2019-12855]
Ubuntu16.04twisted15.5.0-1UnknownSource applicability is not established[UBUNTU-CVE-2019-12855]
Ubuntu16.04twisted15.5.0-2UnknownSource applicability is not established[UBUNTU-CVE-2019-12855]
Ubuntu16.04twisted15.5.0-2ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2019-12855]
Ubuntu16.04twisted15.5.0-4UnknownSource applicability is not established[UBUNTU-CVE-2019-12855]
Ubuntu16.04twisted16.0.0-1UnknownSource applicability is not established[UBUNTU-CVE-2019-12855]
Ubuntu16.04twisted16.0.0-1ubuntu0.2UnknownSource applicability is not established[UBUNTU-CVE-2019-12855]
Ubuntu16.04twisted16.0.0-1ubuntu0.4UnknownSource applicability is not established[UBUNTU-CVE-2019-12855]
Ubuntu16.04twisted16.0.0~pre1-1UnknownSource applicability is not established[UBUNTU-CVE-2019-12855]
Ubuntu16.04twisted16.0.0~pre1-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2019-12855]
Ubuntu16.04twisted16.0.0~pre1-2ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2019-12855]
Ubuntu16.04twisted16.0.0~pre1-3UnknownSource applicability is not established[UBUNTU-CVE-2019-12855]
Ubuntu18.04twisted16.6.0-2ubuntu3UnknownSource applicability is not established[UBUNTU-CVE-2019-12855]
Ubuntu18.04twisted17.9.0-1UnknownSource applicability is not established[UBUNTU-CVE-2019-12855]
Ubuntu18.04twisted17.9.0-2UnknownSource applicability is not established[UBUNTU-CVE-2019-12855]
Ubuntu18.04twisted17.9.0-2ubuntu0.1UnknownSource applicability is not established[UBUNTU-CVE-2019-12855]
Ubuntuprotwisted13.0.0-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2019-12855]
Ubuntuprotwisted13.2.0-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2019-12855]
Ubuntuprotwisted13.2.0-1ubuntu1.2UnknownSource applicability is not established[UBUNTU-CVE-2019-12855]
Ubuntuprotwisted13.2.0-1ubuntu1.2+esm1UnknownSource applicability is not established[UBUNTU-CVE-2019-12855]
Original provider fields
{
  "package_releases": [
    {
      "name": "twisted",
      "status": "fixed",
      "release": "sid",
      "version": "26.4.0-6"
    },
    {
      "name": "twisted",
      "status": "fixed",
      "release": "forky",
      "version": "26.4.0-6"
    },
    {
      "name": "twisted",
      "status": "fixed",
      "release": "trixie",
      "version": "24.11.0-1"
    },
    {
      "name": "twisted",
      "status": "fixed",
      "release": "bookworm",
      "version": "22.4.0-4+deb12u1"
    },
    {
      "name": "twisted",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "22.4.0-4+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 930626,
      "name": "twisted",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "18.9.0-7"
    },
    {
      "bug": 930626,
      "name": "twisted",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "18.9.0-7"
    },
    {
      "bug": 930626,
      "name": "twisted",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "18.9.0-7"
    },
    {
      "bug": 930626,
      "name": "twisted",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "18.9.0-7"
    }
  ],
  "distribution_packages": [
    {
      "name": "python-Twisted",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "17.9.0-lp151.3.6.1"
            }
          ]
        }
      ],
      "release": "leap 15.0",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2019:2068-1",
      "fixed_version": "17.9.0-lp151.3.6.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2019:2068-1",
      "provider_updated_at": "2026-02-04T04:17:07.055568Z",
      "applicability_unknown": true
    },
    {
      "name": "python-Twisted",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "17.9.0-lp151.3.6.1"
            }
          ]
        }
      ],
      "release": "leap 15.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2019:2068-1",
      "fixed_version": "17.9.0-lp151.3.6.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2019:2068-1",
      "provider_updated_at": "2026-02-04T04:17:07.055568Z",
      "applicability_unknown": true
    },
    {
      "name": "python-Twisted",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "17.9.0-bp150.4.6.1"
            }
          ]
        }
      ],
      "release": "package hub 15",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2019:2110-1",
      "fixed_version": "17.9.0-bp150.4.6.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2019:2110-1",
      "provider_updated_at": "2026-02-04T04:00:28.307860Z",
      "applicability_unknown": true
    },
    {
      "name": "twisted",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "13.2.0-1ubuntu1.2+esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "13.0.0-1ubuntu1",
        "13.2.0-1ubuntu1",
        "13.2.0-1ubuntu1.2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2019-12855",
      "fixed_version": "13.2.0-1ubuntu1.2+esm1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2019-12855",
      "provider_updated_at": "2026-02-04T03:04:14.139724Z",
      "applicability_unknown": true
    },
    {
      "name": "twisted",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "16.0.0-1ubuntu0.4"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "15.2.1-1ubuntu2",
        "15.5.0-1",
        "15.5.0-2",
        "15.5.0-2ubuntu1",
        "15.5.0-4",
        "16.0.0~pre1-1",
        "16.0.0~pre1-1ubuntu1",
        "16.0.0~pre1-2ubuntu1",
        "16.0.0~pre1-3",
        "16.0.0-1",
        "16.0.0-1ubuntu0.2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2019-12855",
      "fixed_version": "16.0.0-1ubuntu0.4",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2019-12855",
      "provider_updated_at": "2026-02-04T03:04:14.139724Z",
      "applicability_unknown": true
    },
    {
      "name": "twisted",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "17.9.0-2ubuntu0.1"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "16.6.0-2ubuntu3",
        "17.9.0-1",
        "17.9.0-2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2019-12855",
      "fixed_version": "17.9.0-2ubuntu0.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2019-12855",
      "provider_updated_at": "2026-02-04T03:04:14.139724Z",
      "applicability_unknown": true
    },
    {
      "name": "python-Twisted",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "15.2.1-9.8.1"
            }
          ]
        }
      ],
      "release": "hpe helion openstack 8",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2453-1",
      "fixed_version": "15.2.1-9.8.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2453-1",
      "provider_updated_at": "2025-05-02T04:08:45.394277Z",
      "applicability_unknown": true
    },
    {
      "name": "python-Twisted",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "15.2.1-9.8.1"
            }
          ]
        }
      ],
      "release": "openstack cloud 7",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2453-1",
      "fixed_version": "15.2.1-9.8.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2453-1",
      "provider_updated_at": "2025-05-02T04:08:45.394277Z",
      "applicability_unknown": true
    },
    {
      "name": "python-Twisted",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "15.2.1-9.8.1"
            }
          ]
        }
      ],
      "release": "openstack cloud 8",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2453-1",
      "fixed_version": "15.2.1-9.8.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2453-1",
      "provider_updated_at": "2025-05-02T04:08:45.394277Z",
      "applicability_unknown": true
    },
    {
      "name": "python-Twisted",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "15.2.1-9.8.1"
            }
          ]
        }
      ],
      "release": "openstack cloud 9",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2453-1",
      "fixed_version": "15.2.1-9.8.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2453-1",
      "provider_updated_at": "2025-05-02T04:08:45.394277Z",
      "applicability_unknown": true
    },
    {
      "name": "python-Twisted",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "15.2.1-9.8.1"
            }
          ]
        }
      ],
      "release": "openstack cloud crowbar 8",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2453-1",
      "fixed_version": "15.2.1-9.8.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2453-1",
      "provider_updated_at": "2025-05-02T04:08:45.394277Z",
      "applicability_unknown": true
    },
    {
      "name": "python-Twisted",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "15.2.1-9.8.1"
            }
          ]
        }
      ],
      "release": "openstack cloud crowbar 9",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2453-1",
      "fixed_version": "15.2.1-9.8.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2453-1",
      "provider_updated_at": "2025-05-02T04:08:45.394277Z",
      "applicability_unknown": true
    },
    {
      "name": "python-Twisted",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "15.2.1-9.8.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for web and scripting 12",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2453-1",
      "fixed_version": "15.2.1-9.8.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2453-1",
      "provider_updated_at": "2025-05-02T04:08:45.394277Z",
      "applicability_unknown": true
    },
    {
      "name": "python-Twisted",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "15.2.1-9.8.1"
            }
          ]
        }
      ],
      "release": "enterprise storage 4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2453-1",
      "fixed_version": "15.2.1-9.8.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2453-1",
      "provider_updated_at": "2025-05-02T04:08:45.394277Z",
      "applicability_unknown": true
    },
    {
      "name": "python-Twisted",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "15.2.1-9.8.1"
            }
          ]
        }
      ],
      "release": "enterprise storage 5",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2453-1",
      "fixed_version": "15.2.1-9.8.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2453-1",
      "provider_updated_at": "2025-05-02T04:08:45.394277Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #930626]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [python3-twisted]Unknown

    Source package: [twisted]

    Details (4)

    • 22.4.0-4+deb12u1 · all · bookworm

      Fixed · Fixed: 18.9.0-7

      dsa · twisted · debian · bookworm; dsa · twisted · debian · 12

    • 22.4.0-4+deb12u1 · all · bookworm

      Fixed · Fixed: 18.9.0-7

      dsa · twisted · debian · bookworm; dsa · twisted · debian · 12

    • 22.4.0-4+deb12u1 · all · bookworm-security

      Fixed · Fixed: 18.9.0-7

      dsa · twisted · debian · bookworm; dsa · twisted · debian · 12

    • 22.4.0-4+deb12u1 · all · bookworm-security

      Fixed · Fixed: 18.9.0-7

      dsa · twisted · debian · bookworm; dsa · twisted · debian · 12

  • [twisted-doc]Unknown

    Source package: [twisted]

    Details (4)

    • 22.4.0-4+deb12u1 · all · bookworm

      Fixed · Fixed: 18.9.0-7

      dsa · twisted · debian · bookworm; dsa · twisted · debian · 12

    • 22.4.0-4+deb12u1 · all · bookworm

      Fixed · Fixed: 18.9.0-7

      dsa · twisted · debian · bookworm; dsa · twisted · debian · 12

    • 22.4.0-4+deb12u1 · all · bookworm-security

      Fixed · Fixed: 18.9.0-7

      dsa · twisted · debian · bookworm; dsa · twisted · debian · 12

    • 22.4.0-4+deb12u1 · all · bookworm-security

      Fixed · Fixed: 18.9.0-7

      dsa · twisted · debian · bookworm; dsa · twisted · debian · 12

[Debian 13 (Trixie)]

  • [python3-twisted]Unknown

    Source package: [twisted]

    Details (2)

    • 24.11.0-1 · all · trixie

      Fixed · Fixed: 18.9.0-7

      dsa · twisted · debian · 13

    • 24.11.0-1 · all · trixie

      Fixed · Fixed: 18.9.0-7

      dsa · twisted · debian · 13

  • [twisted-doc]Unknown

    Source package: [twisted]

    Details (2)

    • 24.11.0-1 · all · trixie

      Fixed · Fixed: 18.9.0-7

      dsa · twisted · debian · 13

    • 24.11.0-1 · all · trixie

      Fixed · Fixed: 18.9.0-7

      dsa · twisted · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]