PT-2014-8715 · Processone+1 · Ejabberd+1

Weiss · Published 2014-10-23 · Updated 2016-04-11 · CVE-2014-8760

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ejabberd versions prior to 2.1.13

Description The issue causes clients to establish connections without encryption when compression is used, due to the failure to enforce the starttls required setting.

Recommendations For versions prior to 2.1.13, update to version 2.1.13 or later to resolve the issue. As a temporary workaround, consider disabling compression until a patch is available. Restrict access to unencrypted connections to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

ALT-PU-2016-1317

CVE-2014-8760

DLA-881-1

MGASA-2014-0417

Affected Products

Alt Linux

Ejabberd

References · 20

• https://github.com/processone/ejabberd/commit/7bdc1151b · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8760 · Security Note
• https://osv.dev/vulnerability/CVE-2014-8760 · Vendor Advisory
• http://advisories.mageia.org/MGASA-2014-0417.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0417 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6169 · Security Note
• https://advisories.mageia.org/MGASA-2014-0417.html · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2015:175 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-8760 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-8760 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2016-1317 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-8760 · Security Note
• https://bugs.mageia.org/show_bug.cgi?id=14305 · Note
• http://seclists.org/oss-sec/2014/q4/312 · Note
• http://mandriva.com/security/advisories?name=MDVSA-2014:207 · Patch, Vendor Advisory