CVE-2016-10027

Published January 12th, 2017

View on NVD ↗

CVSS v3

5.9

MEDIUM

CVSS v2

4.3

MEDIUM

Affected

PROJECT

Description

Race condition in the XMPP library in Smack before 4.1.9, when the SecurityMode.required TLS setting has been set, allows man-in-the-middle attackers to bypass TLS protections and trigger use of cleartext for client authentication by stripping the "starttls" feature from a server response.

igniterealtime/Smack

A modular and portable open source XMPP client library written in Java for Android and Java (SE) VMs

GitHub

2.41K