[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAJt9-x5xY3ikisc=RZ1=tqNO+8Tm8YLfjVw=3=UQ2_nAP_7Oiw@mail.gmail.com>
Date: Wed, 11 Aug 2021 08:09:57 +0100
From: Matthew Wild <mwild1@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: STARTTLS vulnerabilities
On Tue, 10 Aug 2021 at 14:52, Guido Berhoerster <
guido+openwall.com@...hoerster.name> wrote:
> Hi,
>
> have you or are you planning to look into XMPP client/server
> implementations as well? The use of STARTTLS for both c2s and s2s
> connections is still prevalent both in terms of implementation
> support and actual practice and could potentially suffer form the
> same issues (command injection or downgrade attacks).
XMPP has some additional protections against this in its design. It is
required, after TLS negotiation, for both parties to discard the pre-TLS
XML stream and negotiate a new one after TLS has been established[1].
Combined with TLS being considered mandatory by practically all modern
implementations and deployments[2], I'd hope that the attacks described
here do not translate well to the XMPP ecosystem.
However we all know standards are not always reflective of the real world.
We (the XMPP Standards Foundation and community) are always open to
researchers interested in this kind of thing, and have collaborated in the
past for coordinating disclosure of cross-implementation vulnerabilities.
Regards,
Matthew
[1]: https://xmpp.org/rfcs/rfc6120.html#tls-process-neg-success
[2]: https://xmpp.org/2013/11/xmpp-ubiquitous-encryption-a-manifesto/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
