Medium
Security advisory
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Jitsi 2.5.5061 - 2.9.5544.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-5603
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:11 UTC · Revision 1
Source evidence
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Jitsi 2.5.5061 - 2.9.5544.
osv:CVE-2017-5603
Complete source record
{
"id": "37a33b12ec6622e2bce478d4fbdf0a3a926ca12a8b082ce535af52c6116b7a61",
"url": "https://osv.dev/vulnerability/CVE-2017-5603",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-5603",
"summary": "An incorrect implementation of \"XEP-0280: Message Carbons\" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Jitsi 2.5.5061 - 2.9.5544.",
"evidence": "osv:CVE-2017-5603",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2017-5603",
"aliases": [
"CVE-2017-5603"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/jitsi/jitsi",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "7d66da61b316c9480b63000f831b6de723b87315"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "7d66da61b316c9480b63000f831b6de723b87315"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"5544",
"5543",
"5542",
"5541",
"5540",
"5539",
"5538",
"5537",
"5536",
"5535",
"5534",
"5533",
"5532",
"5531",
"5530",
"5529",
"5528",
"5527",
"5526",
"5525",
"5524",
"5523",
"5522",
"5521",
"5520",
"5519",
"5518",
"5517",
"5516",
"5515",
"5514",
"5513",
"5512",
"5511",
"5510",
"5509",
"5508",
"5507",
"5506",
"5505",
"5504",
"5503",
"5502",
"5501",
"5500",
"5499",
"5498",
"5497",
"5496",
"5495",
"5494",
"5493",
"5492",
"5491",
"5490",
"5489",
"5488",
"5487",
"5486",
"5485",
"5484",
"5483",
"5482",
"5481",
"5480",
"5479",
"5478",
"5477",
"5476",
"5475",
"5474",
"5473",
"5472",
"5471",
"5470",
"5469",
"5468",
"5467",
"5466",
"5465",
"5464",
"5463",
"5462",
"5461",
"5460",
"5459",
"5458",
"5457",
"5456",
"5455",
"5454",
"5453",
"5452",
"5451",
"5450",
"5449",
"5448",
"5447",
"5446",
"5445",
"5444",
"5443",
"5442",
"5441",
"Jitsi-2.8",
"5426",
"5440",
"5439",
"5438",
"5437",
"5436",
"5435",
"5434",
"5433",
"5432",
"5431",
"5430",
"5429",
"5428",
"5427",
"5425",
"5424",
"5423",
"5422",
"5421",
"5420",
"5419",
"5418",
"5417",
"5416",
"5415",
"5401",
"5414",
"5413",
"5412",
"5411",
"5410",
"5409",
"5408",
"5407",
"5406",
"5405",
"5404",
"5403",
"5402",
"5400",
"5399",
"5398",
"5397",
"5396",
"5395",
"5394",
"5393",
"5392",
"5391",
"Jitsi-2.6",
"5390",
"5389",
"5388",
"5387",
"5386",
"5385",
"5384",
"5383",
"5382",
"5381",
"5380",
"5379",
"5378",
"5377",
"5376",
"5375",
"5374",
"5373",
"5372",
"5371",
"5370",
"5369",
"5368",
"5367",
"5366",
"5365",
"5364",
"5363",
"5362",
"5361",
"5360",
"5359",
"5358",
"5357",
"5356",
"5355",
"5354",
"5353",
"5352",
"5351",
"5350",
"5349",
"5348",
"5347",
"5346",
"5345",
"5344",
"5343",
"5342",
"5341",
"5340",
"5339",
"5338",
"5337",
"5336",
"5335",
"5334",
"5333",
"5332",
"5331",
"5330",
"5329",
"5328",
"5327",
"5326",
"5325",
"5324",
"5323",
"5322",
"5321",
"5320",
"5319",
"5318",
"5317",
"5316",
"5315",
"5314",
"5313",
"5312",
"5311",
"5310",
"5309",
"5308",
"5307",
"5306",
"5305",
"5304",
"5303",
"5302",
"5301",
"5300",
"5299",
"5298",
"5297",
"5296",
"5295",
"5294",
"5293",
"5292",
"5291",
"5290",
"5289",
"5288",
"5287",
"5286",
"5285",
"5275",
"5274",
"5273",
"5271",
"5272",
"5270",
"5269",
"5268",
"5267",
"5266",
"5265",
"5264",
"5263",
"5262",
"5261",
"5260",
"5259",
"5258",
"5257",
"5256",
"5255",
"5254",
"5253",
"5252",
"5251",
"5250",
"5249",
"5248",
"5247",
"5246",
"5245",
"5244",
"5243",
"5240",
"5239",
"5238",
"5237",
"5236",
"5235",
"5234",
"5233",
"5231",
"5230",
"5229",
"5228",
"5227",
"5226",
"5225",
"5224",
"5223",
"5222",
"5221",
"5220",
"5219",
"5218",
"5217",
"5216",
"5215",
"5214",
"5213",
"5212",
"5211",
"5210",
"5209",
"5208",
"5207",
"5206",
"5205",
"5204",
"5203",
"5202",
"5201",
"5200",
"5199",
"5198",
"5197",
"5196",
"5195",
"5194",
"5193",
"5192",
"5191",
"5190",
"5189",
"5188",
"5187",
"5186",
"5185",
"5184",
"5183",
"5182",
"5181",
"5180",
"5179",
"5178",
"5177",
"5176",
"5175",
"5174",
"5173",
"5172",
"5171",
"5170",
"5169",
"5168",
"5167",
"5166",
"5165",
"5164",
"5163",
"5162",
"5161",
"5160",
"5159",
"5158",
"5157",
"5156",
"5155",
"5154",
"5153",
"5152",
"5151",
"5150",
"5149",
"5148",
"5147",
"5146",
"5145",
"5144",
"5143",
"5142",
"5141",
"5140",
"5139",
"5138",
"5137",
"5136",
"5135",
"5134",
"5133",
"5132",
"5131",
"5130",
"5129",
"5128",
"5127",
"5126",
"5125",
"5124",
"5123",
"5122",
"5121",
"5120",
"5119",
"5118",
"5117",
"5116",
"5115",
"5112",
"5114",
"5113",
"5111",
"5110",
"5109",
"5108",
"5107",
"5106",
"5105",
"5104",
"5103",
"5102",
"5101",
"5100",
"5099",
"5098",
"5097",
"5096",
"5095",
"5094",
"5093",
"5092",
"5091",
"5090",
"5089",
"5088",
"5087",
"5086",
"5085",
"5084",
"5083",
"5082",
"5081",
"5080",
"5079",
"5078",
"5077",
"5076",
"5075",
"5074",
"5073",
"5072",
"5071",
"5070",
"5069",
"5068",
"5067",
"5066",
"5065",
"5064",
"5063",
"5062",
"5061",
"5060",
"5059",
"5058",
"5057",
"5056",
"5055",
"5054",
"5053",
"5052",
"5051",
"5050",
"5049",
"5048",
"5047",
"5046",
"5045",
"5044",
"5043",
"5042",
"5041",
"5040",
"5039",
"5038",
"5037",
"5036",
"5035",
"5034",
"5033",
"5032",
"5031",
"5030",
"5029",
"5028",
"5027",
"5026",
"5025",
"5024",
"5023",
"5022",
"5021",
"5020",
"5019",
"5018",
"5017",
"5016",
"5015",
"5014",
"5013",
"5012",
"5011",
"5010",
"5009",
"5008",
"5007",
"5006",
"5005",
"5004",
"5003",
"5002",
"5001",
"5000",
"4999",
"4998",
"Jitsi-2.4",
"4997",
"4996",
"4995",
"4994",
"4993",
"4992",
"4991",
"4990",
"4989",
"4988",
"4987",
"4986",
"4985",
"4984",
"4983",
"4982",
"4981",
"4980",
"4979",
"4978",
"4977",
"4976",
"4975",
"4974",
"4973",
"4972",
"4971",
"4970",
"4969",
"4968",
"4967",
"4966",
"4965",
"4964",
"4963",
"4962",
"4961",
"4960",
"4959",
"4958",
"4957",
"4956",
"4955",
"4954",
"4953",
"4952",
"4951",
"4950",
"4949",
"4948",
"4947",
"4946",
"4945",
"4944",
"4943",
"4942",
"4941",
"4940",
"4939",
"4938",
"4937",
"4936",
"4935",
"4934",
"4933",
"4932",
"4931",
"4930",
"4929",
"4928",
"4927",
"4926",
"4925",
"4924",
"4923",
"4922",
"4921",
"4920",
"4919",
"4918",
"4917",
"4916",
"4915",
"4914",
"4913",
"4912",
"4911",
"4910",
"4909",
"4908",
"4907",
"4906",
"4905",
"4904",
"4903",
"4902",
"4901",
"4900",
"4899",
"4898",
"4897",
"4896",
"4895",
"4894",
"4893",
"4892",
"4891",
"4882",
"4890",
"4889",
"4888",
"4887",
"4886",
"4885",
"4884",
"4883",
"4881",
"4880",
"4879",
"4878",
"4877",
"4876",
"4875",
"4874",
"4873",
"4872",
"4871",
"4870",
"4869",
"4868",
"4867",
"4866",
"4865",
"4864",
"4863",
"4862",
"4861",
"4860",
"4859",
"4858",
"4857",
"4856",
"4855",
"4854",
"4853",
"4852",
"4851",
"4850",
"4849",
"4848",
"4847",
"4846",
"4845",
"4844",
"4843",
"4842",
"4841",
"4840",
"4839",
"4838",
"4837",
"4836",
"4835",
"4834",
"4833",
"4832",
"4831",
"4830",
"4829",
"4828",
"4827",
"4826",
"4825",
"4824",
"4823",
"4822",
"4821",
"4820",
"4819",
"4818",
"4817",
"4816",
"4815",
"4814",
"4813",
"4812",
"4811",
"4810",
"4809",
"4808",
"4807",
"4806",
"4805",
"4804",
"4803",
"4802",
"4801",
"4800",
"4799",
"4798",
"4797",
"4796",
"4795",
"4794",
"4793",
"4792",
"4791",
"4790",
"4789",
"4788",
"4787",
"4786",
"4784",
"4783",
"4782",
"4781",
"4780",
"4779",
"4778",
"4777",
"4776",
"4775",
"4774",
"4773",
"4772",
"4771",
"4770",
"4769",
"4768",
"4767",
"4766",
"4765",
"4764",
"4763",
"4762",
"4761",
"4760",
"4759",
"4758",
"4757",
"4756",
"4755",
"4754",
"4753",
"4752",
"4751",
"4750",
"4749",
"4742",
"4740",
"4736",
"4735",
"4734",
"4733",
"4731",
"4721",
"4718",
"4717",
"4714",
"Jitsi-2.2",
"Jitsi-2.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-5603.json",
"vanir_signatures": [
{
"id": "CVE-2017-5603-34cc6793",
"digest": {
"threshold": 0.9,
"line_hashes": [
"107578669910084079894611907846344324764",
"143909334712409636331827581362332141657",
"12902339851635929102351687526928292194",
"324089159069590738857614046580844865286"
]
},
"source": "https://github.com/jitsi/jitsi/commit/7d66da61b316c9480b63000f831b6de723b87315",
"target": {
"file": "src/net/java/sip/communicator/impl/protocol/jabber/OperationSetBasicInstantMessagingJabberImpl.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-5603-c259804c",
"digest": {
"length": 3643,
"function_hash": "273513514354543505449521079392273462612"
},
"source": "https://github.com/jitsi/jitsi/commit/7d66da61b316c9480b63000f831b6de723b87315",
"target": {
"file": "src/net/java/sip/communicator/impl/protocol/jabber/OperationSetBasicInstantMessagingJabberImpl.java",
"function": "processPacket"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:16:32Z"
}
}
],
"modified": "2026-10-20T13:16:32.383379425Z",
"provider": "osv",
"references": [
"https://github.com/jitsi/jitsi/commit/7d66da61b316c9480b63000f831b6de723b87315",
"https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/",
"https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:jitsi:jitsi:2.5.5061:*:*:*:*:*:*:*",
"cpe:2.3:a:jitsi:jitsi:2.9.5544:*:*:*:*:*:*:*"
],
"vendor_product": "jitsi:jitsi",
"extracted_events": [
{
"range": [
{
"introduced": "2.5.5061"
},
{
"last_affected": "2.5.5061"
},
{
"introduced": "2.9.5544"
},
{
"last_affected": "2.9.5544"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2017-5603",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387435,
"published_at": "2017-02-09T20:59:00.42+00:00"
}