CVE-2017-10807: Critical severity jabberd2 jabberd2 vulnerability
JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/jabberd2to a version that resolves this vulnerability.Fixed in 2.7.0-4Fixed in 2.7.0-8Fixed in 2.7.0-10 - Upgrade
Upgrade
ubuntu/jabberd2to a version that resolves this vulnerability.Fixed in 2.3.4-1ubuntu2+esm1 - Upgrade
Upgrade
JabberD (jabberd2)to a version that resolves this vulnerability.Fixed in 2.6.1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-10807?
CVE-2017-10807 is classified as a moderate severity vulnerability.
How do I fix CVE-2017-10807?
To fix CVE-2017-10807, upgrade to JabberD version 2.6.1 or later.
What systems are affected by CVE-2017-10807?
CVE-2017-10807 affects JabberD versions prior to 2.6.1.
What vulnerability does CVE-2017-10807 expose?
CVE-2017-10807 allows unauthorized users to authenticate using SASL ANONYMOUS.
Is CVE-2017-10807 an authenticated or unauthenticated vulnerability?
CVE-2017-10807 is an unauthenticated vulnerability as it allows anyone to authenticate regardless of configuration.