CVE-2022-24968

https://notcve.org/view.php?id=CVE-2022-24968

11 Feb 2022 — In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail. This occurs because the wrong host name is selected during this verification. En Mellium mellium.im/xmpp versiones hasta 0.21.0, un atacante capaz de falsificar los registros TXT de DNS puede redirigir una petición de conexión WebSocket a un servidor bajo su control sin causar que falle la ... • https://mellium.im/cve/cve-2022-24968 • CWE-295: Improper Certificate Validation •