CVE-2016-10027

Race condition in the XMPP library in Smack before 4.1.9, when the SecurityMode.required TLS setting has been set, allows man-in-the-middle attackers to bypass…

published January 12, 2017

CVSS
—
EPSS
2%
Percentile
74.1
In the wild
Unconfirmed
What it is

Race condition in the XMPP library in Smack before 4.1.9, when the SecurityMode.required TLS setting has been set, allows man-in-the-middle attackers to bypass TLS protections and trigger use of cleartext for client authentication by stripping the "starttls" feature from a server response.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01513 · 74.1th percentile
Published
2017-01-12T23:00Z
EPSS history
Timeline
  • 12 JAN 23:00Z
    Race condition in the XMPP library in Smack before 4.1.9, when the SecurityMode.required TLS setting has been set, allows man-in-the-middle attackers to bypass…
    cvelistv5