CVE-2021-34825: High severity quassel irc vulnerability
Quassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a usable X.509 certificate is not found on the local system.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-34825?
CVE-2021-34825 is rated as a moderate vulnerability due to the potential for unencrypted communication when SSL is required but not supported.
How do I fix CVE-2021-34825?
To fix CVE-2021-34825, ensure that a usable X.509 certificate is installed before launching Quassel with the --require-ssl option.
What systems are affected by CVE-2021-34825?
CVE-2021-34825 affects Quassel versions up to 0.13.1 and specific Fedora releases including version 33 and 34.
What happens if I run Quassel with --require-ssl but no certificate for CVE-2021-34825?
If no usable X.509 certificate is found, Quassel will launch without SSL or TLS support, exposing the communication.
Is there a workaround for CVE-2021-34825?
A temporary workaround for CVE-2021-34825 is to remove the --require-ssl flag until an appropriate certificate is deployed.