CVE-2022-24976 - Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence

Back Back to CVE browser

CRITICAL

Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence

Published Feb 13, 2022

9.1

CRITICAL

CVSS 3.1

EPSS 1.82%

Description

Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-29726
Advisory
https://github.com/atheme/atheme/commit/4e664c75d0b280a052eb8b5e81aa41944e593c52
x_refsource_MISCPatchThird Party Advisory
https://github.com/atheme/atheme/compare/v7.2.11...v7.2.12
x_refsource_MISCPatchThird Party Advisory
https://www.openwall.com/lists/oss-security/2022/01/30/4
x_refsource_MISCExploitMailing ListThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-29726		Advisory
https://github.com/atheme/atheme/commit/4e664c75d0b280a052eb8b5e81aa41944e593c52		x_refsource_MISCPatchThird Party Advisory
https://github.com/atheme/atheme/compare/v7.2.11...v7.2.12		x_refsource_MISCPatchThird Party Advisory
https://www.openwall.com/lists/oss-security/2022/01/30/4		x_refsource_MISCExploitMailing ListThird Party Advisory