Описание
ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.
Ссылки
- Vendor Advisory
- Patch
- Patch
- Vendor Advisory
- Patch
- Patch
Уязвимые конфигурации
Конфигурация 1Версия до 2.1.12 (включая)
cpe:2.3:a:process-one:ejabberd:*:*:*:*:*:*:*:*
EPSS
Процентиль: 71%
0.01314
Низкий
5 Medium
CVSS2
Дефекты
CWE-310
Связанные уязвимости
ubuntu
около 12 лет назад
ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.
debian
около 12 лет назад
ejabberd before 2.1.13 does not enforce the starttls_required setting ...
github
больше 4 лет назад
ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.
altlinux
больше 10 лет назад
ALT-PU-2016-1317: package `ejabberd` update to version 2.1.13-alt1
EPSS
Процентиль: 71%
0.01314
Низкий
5 Medium
CVSS2
Дефекты
CWE-310