PT-2014-8715 · Processone+1 · Ejabberd+1

Weiss · Publicado 2014-10-23 · Atualizado 2016-04-11 · CVE-2014-8760

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ejabberd versions prior to 2.1.13

Description The issue causes clients to establish connections without encryption when compression is used, due to the failure to enforce the starttls required setting.

Recommendations For versions prior to 2.1.13, update to version 2.1.13 or later to resolve the issue. As a temporary workaround, consider disabling compression until a patch is available. Restrict access to unencrypted connections to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

ALT-PU-2016-1317

CVE-2014-8760

DLA-881-1

MGASA-2014-0417

Produtos afetados

Alt Linux

Ejabberd

Referências · 20

• https://github.com/processone/ejabberd/commit/7bdc1151b · Correção
• https://bugs.mageia.org/show_bug.cgi?id=14305 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8760 · Nota de Segurança
• http://seclists.org/oss-sec/2014/q4/312 · Nota
• https://osv.dev/vulnerability/CVE-2014-8760 · Aviso do Fabricante
• http://advisories.mageia.org/MGASA-2014-0417.html · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2014-0417 · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDVSA-2014:207 · Correção, Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6169 · Nota de Segurança
• https://packages.altlinux.org/ru/vuln/CVE-2014-8760 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1153839 · Nota
• https://advisories.mageia.org/MGASA-2014-0417.html · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/10/16/7 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2015:175 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-8760 · Aviso do Fabricante