Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 4 Jul 2017 17:03:38 +0200
From: Salvatore Bonaccorso <>
To: OSS Security Mailinglist <>
Subject: jabberd2: CVE-2017-10807: Allows to authenticate using SASL
 ANONYMOUS even if disabled


The Jabberd, before 2.6.1 allowed anyone to authenticate SASL
ANONYMOUS, even when sasl.anonymous c2s.xml option is not enabled.
The bug allows nauthorized usage of jabberd server installations and
could possibly lead to a DoS.


Upstream fix:

As mentioned in the subject, MITRE has assigned CVE-2017-10807 for
this issue.


Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ