PT-2021-4270 · Quassel+1 · Quassel+1

Chris Egeland · Published 2021-06-17 · Updated 2022-07-12 · CVE-2021-34825

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Quassel versions prior to 0.13.1

Description The issue is related to the --require-ssl parameter, which can cause Quassel to launch without SSL or TLS support if a usable X.509 certificate is not found on the local system. This could allow a remote attacker to access confidential data.

Recommendations For versions prior to 0.13.1, ensure that a usable X.509 certificate is properly configured on the local system to prevent Quassel from launching without SSL or TLS support. As a temporary workaround, consider disabling the --require-ssl parameter until a proper certificate is configured.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-319

CWE-311

Related Identifiers

BDU:2021-04878

CVE-2021-34825

MGASA-2021-0382

Affected Products

Debian

Quassel

References · 19

• 🔥 https://github.com/quassel/quassel/pull/581 · Exploit
• https://ubuntu.com/security/CVE-2021-34825 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-34825 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-34825 · Security Note
• https://advisories.mageia.org/MGASA-2021-0382.html · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0382 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/7ZFWRN5P2WG23MWMVAEVV3YBHGFJHDSW · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04878 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JOFTSGJUJHCA3KGQBO6OZXWU7JFKVHMJ · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-34825 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZFWRN5P2WG23MWMVAEVV3YBHGFJHDSW · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-34825 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34825 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-34825 · Vendor Advisory
• https://t.me/cvenotify/16878 · Telegram Post