CVE-2016-7142

EUVD-2016-8014
The m_sasl module in InspIRCd before 2.0.23, when used with a service that supports SASL_EXTERNAL authentication, allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted SASL message.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 33%
Affected Products (NVD)
VendorProductVersion
inspircdinspircd
𝑥
≤ 2.0.22
debiandebian_linux
8.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
inspircd
bookworm
3.15.0-1
fixed
bullseye
3.8.1-2
fixed
sid
3.17.0-1
fixed
trixie
3.17.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
inspircd
artful
ignored
bionic
not-affected
cosmic
not-affected
disco
not-affected
eoan
not-affected
focal
not-affected
groovy
not-affected
hirsute
not-affected
impish
not-affected
jammy
not-affected
kinetic
not-affected
lunar
not-affected
mantic
not-affected
noble
not-affected
precise
ignored
trusty
dne
xenial
needed
yakkety
ignored
zesty
ignored
Common Weakness Enumeration
References
http://www.debian.org/security/2016/dsa-3662
http://www.inspircd.org/2016/09/03/v2023-released.html
http://www.openwall.com/lists/oss-security/2016/09/04/3
http://www.openwall.com/lists/oss-security/2016/09/05/8
https://github.com/inspircd/inspircd/commit/74fafb7f11b06747f69f182ad5e3769b665eea7a
http://www.debian.org/security/2016/dsa-3662
http://www.inspircd.org/2016/09/03/v2023-released.html
http://www.openwall.com/lists/oss-security/2016/09/04/3
http://www.openwall.com/lists/oss-security/2016/09/05/8
https://github.com/inspircd/inspircd/commit/74fafb7f11b06747f69f182ad5e3769b665eea7a