Bug 525478 – <net-im/ejabberd-16.04: compression can circumvent starttls_required and allow insecure connections

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Hanno Böck 2014-10-15 08:37:27 UTC]

ejabberd has a vulnerability that allows insecure/unencrypted connections even if the server setting is starttls_required.
http://mail.jabber.org/pipermail/operators/2014-October/002438.html

This is the upstream fix, not in a release yet:
https://github.com/processone/ejabberd/commit/7bdc1151b

I consider this to be quite severe.

[Comment 1 GLSAMaker/CVETool Bot 2015-01-04 21:35:56 UTC]

CVE-2014-8760 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8760):
  ejabberd before 2.1.13 does not enforce the starttls_required setting when
  compression is used, which causes clients to establish connections without
  encryption.

[Comment 2 Tim Harder 2015-04-12 05:39:02 UTC]

I assume the fix is probably in 15.03 now in the tree.

[Comment 3 Amadeusz Żołnowski (RETIRED) 2016-06-07 22:51:55 UTC]

ejabberd-16.04 has been committed to the tree and it is a candidate for stabilization. Maybe it should be stabilized sooner?

[Comment 4 Amadeusz Żołnowski (RETIRED) 2016-08-21 10:57:23 UTC]

ejabber-16.04 is stabilized. The issue should be fixed.

[Comment 5 Thomas Deutschmann (RETIRED) 2016-11-18 20:42:47 UTC]

@ Security: Please vote!

[Comment 6 Kristian Fiskerstrand (RETIRED) 2016-11-18 21:01:34 UTC]

GLSA Vote: No