search

xmppjs / xmpp.js

XMPP for JavaScript
ISC License
2.18k stars 371 forks source link

XEP-0156 _xmppconnect is vulnerable to MITM #933

Closed moparisthebest closed 2 years ago

moparisthebest commented 2 years ago

Context: https://mail.jabber.org/pipermail/standards/2022-February/038759.html

Vulnerable code: https://github.com/xmppjs/xmpp.js/blob/63aecc49157980f6d68cc58605cf8a3fef664a2a/packages/resolve/lib/dns.js#L39

sonnyp commented 2 years ago

Thank you.