* This issue affects the version of calamari-server(embeds python-twisted) as shipped with Kylin Ceph Storage 2 as it does not check for TLS certificate.
* This issue did not affect the versions of python-twisted-core as shipped with Kylin Gluster Storage 3, Kylin Ceph Storage 2 and 3 as it does not ship XMPP XML Stream bits.
This issue affects the versions of python-twisted-words as shipped with Kylin Enterprise Linux 6 and 7.
Kylin Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Kylin Enterprise Linux Life Cycle: https://access.Kylin.com/support/policy/updates/errata/.
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.