oss-sec mailing list archives
jabberd2: CVE-2017-10807: Allows to authenticate using SASL ANONYMOUS even if disabled
From: Salvatore Bonaccorso <carnil () debian org>
Date: Tue, 4 Jul 2017 17:03:38 +0200
Hi The Jabberd, before 2.6.1 allowed anyone to authenticate SASL ANONYMOUS, even when sasl.anonymous c2s.xml option is not enabled. The bug allows nauthorized usage of jabberd server installations and could possibly lead to a DoS. References: https://github.com/jabberd2/jabberd2/releases/tag/jabberd-2.6.1 Upstream fix: https://github.com/jabberd2/jabberd2/commit/8416ae54ecefa670534f27a31db71d048b9c7f16 As mentioned in the subject, MITRE has assigned CVE-2017-10807 for this issue. Regards, Salvatore
Current thread:
- jabberd2: CVE-2017-10807: Allows to authenticate using SASL ANONYMOUS even if disabled Salvatore Bonaccorso (Jul 04)