CVE-2017-10807
jabberd: Jabberd before 2.6.1 allows anyone to authenticate using SASLANONYMOUS even when this option is disabled
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Red Hat (orta), Ubuntu (orta).
Açıklama
JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| debian 11 | jabberd2 | 2.6.1-1 |
| debian 12 | jabberd2 | 2.6.1-1 |
| debian 13 | jabberd2 | 2.6.1-1 |
| debian 14 | jabberd2 | 2.6.1-1 |
| debian 9 | jabberd2 | 2.4.0-3+deb9u1 |
| echo | jabberd2 | 2.6.1-1 |
| ubuntu 17.04 | jabberd2 | 2.4.0-3+deb9u1build0.17.04.1 |
Referanslar
- http://www.debian.org/security/2017/dsa-3902
- http://www.securityfocus.com/bid/99511
- https://access.redhat.com/security/cve/CVE-2017-10807
- https://bugs.debian.org/867032
- https://github.com/jabberd2/jabberd2/commit/8416ae54ecefa670534f27a31db71d048b9c7f16
- https://github.com/jabberd2/jabberd2/releases/tag/jabberd-2.6.1
- https://nvd.nist.gov/vuln/detail/CVE-2017-10807
- https://www.cve.org/CVERecord?id=CVE-2017-10807