CVE-2022-24968: TLS certificate validation error

February 12, 2022 (updated February 15, 2022)

In mellium.im/xmpp, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail. This occurs because the wrong host name is selected during this verification.

References

github.com/advisories/GHSA-m658-p24x-p74r
mellium.im/cve/cve-2022-24968/
mellium.im/xmpp/
nvd.nist.gov/vuln/detail/CVE-2022-24968

Code Behaviors & Features

Detect and mitigate CVE-2022-24968 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →