Date: Wed, 11 Aug 2021 08:09:57 +0100 From: Matthew Wild <mwild1@...il.com> To: oss-security@...ts.openwall.com Subject: Re: STARTTLS vulnerabilities On Tue, 10 Aug 2021 at 14:52, Guido Berhoerster < guido+openwall.com@...hoerster.name> wrote: > Hi, > > have you or are you planning to look into XMPP client/server > implementations as well? The use of STARTTLS for both c2s and s2s > connections is still prevalent both in terms of implementation > support and actual practice and could potentially suffer form the > same issues (command injection or downgrade attacks). XMPP has some additional protections against this in its design. It is required, after TLS negotiation, for both parties to discard the pre-TLS XML stream and negotiate a new one after TLS has been established. Combined with TLS being considered mandatory by practically all modern implementations and deployments, I'd hope that the attacks described here do not translate well to the XMPP ecosystem. However we all know standards are not always reflective of the real world. We (the XMPP Standards Foundation and community) are always open to researchers interested in this kind of thing, and have collaborated in the past for coordinating disclosure of cross-implementation vulnerabilities. Regards, Matthew : https://xmpp.org/rfcs/rfc6120.html#tls-process-neg-success : https://xmpp.org/2013/11/xmpp-ubiquitous-encryption-a-manifesto/
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.