Cloudanix VulnDB

CVE-2021-41055

High · 7.5

CVSS

7.5

EPSS

1.6%

Published

Oct 11, 2021

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A chat application can be made to crash when someone sends a specially formatted correction message in a group conversation.

Exploit Available
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Remote unauthenticated attacker can trigger a client crash in Gajim by sending a single XMPP Last Message Correction (XEP-0308) stanza in a multi-user chat where the message ID equals the correction ID, causing an unhandled exception during message processing.

Why it matters to the business

Affected users experience sudden application crashes during normal group-chat usage, interrupting real-time communications and requiring manual restarts that reduce productivity for teams relying on XMPP.

How an attack unfolds

An attacker joins the same multi-user XMPP room as the victim, crafts a Last Message Correction stanza whose 'id' attribute matches the 'id' of the correction element, and transmits the stanza; the vulnerable client processes the stanza without validating the ID relationship and crashes.

How to fix it

Upgrade Gajim to version 1.3.3 or newer; if immediate upgrade is not possible, disable the Last Message Correction feature or restrict participation in untrusted multi-user chats.

How to confirm the fix worked

Verify installed Gajim version is 1.3.3 or later; replay a synthetic XEP-0308 stanza with matching IDs in a test MUC and confirm the client no longer crashes; review release notes for the fix commit.

Typical attack path

  1. Locate or join a multi-user XMPP chat containing the target Gajim user
  2. Construct a Last Message Correction stanza with identical message and correction IDs
  3. Transmit the stanza over the XMPP connection to trigger the crash

How to detect it

Review XMPP client logs and MUC message archives for incoming correction stanzas containing identical 'id' values on both the outer message and the replace element; correlate timestamps with client crash reports or restarts.

What your security team should do

  • Prioritize upgrade of all Gajim instances to 1.3.3 or later within the next maintenance window
  • Add Gajim version checks to endpoint inventory and blocklist older builds
  • Educate users on avoiding untrusted public XMPP rooms until patched

The record

Gajim 1.2.x and 1.3.x before 1.3.3 allows remote attackers to cause a denial of service (crash) via a crafted XMPP Last Message Correction (XEP-0308) message in multi-user chat, where the message ID equals the correction ID.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 python-nbxmpp 0 2.0.2-1+deb11u1
Debian:12 python-nbxmpp 0 2.0.4-1
Debian:13 python-nbxmpp 0 2.0.4-1
Mageia:8 python-nbxmpp 0 2.0.4-1.mga8
Ubuntu:16.04:LTS python-nbxmpp 0 No fix
Ubuntu:Pro:16.04:LTS python-nbxmpp 0 No fix
openSUSE:Tumbleweed gajim 0 1.3.3-1.1

Related vulnerabilities