USN-9084-1: Radicale vulnerability
It was discovered that Radicale did not delay failed authentication attempts when using htpasswd authentication. A remote attacker could possibly use this issue to obtain user passwords through timing or brute-force attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/python-radicaleto a version that resolves this vulnerability.Fixed in 1.1.1-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/python3-radicaleto a version that resolves this vulnerability.Fixed in 1.1.1-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/radicaleto a version that resolves this vulnerability.Fixed in 1.1.1-1ubuntu0.1~esm1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects Radicale deployments that use htpasswd authentication. The advisory does not state whether htpasswd authentication is the default configuration.
What does an attacker need to exploit it?
An attacker can attempt exploitation remotely by making failed authentication attempts. The missing delay could make timing or brute-force attacks against user passwords more feasible.