Description
(1) iodined.c and (2) user.c in iodine before 0.7.0 allows remote attackers to bypass authentication by continuing execution after an error has been triggering.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | iodine | 0.6.0~rc1-19 | — |
| Debian 13 | iodine | 0.6.0~rc1-19 | — |
| Debian 12 | iodine | 0.6.0~rc1-19 | — |
| Debian 7 | iodine | 0.6.0~rc1-12+deb7u1 | DSA-2964-1 |
Advisories 1
- DSA-2964-1 iodine - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- 59417 third-party-advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=751834
- [oss-security] 20140617 Re: CVE Request: iodine: authentication bypass by client mailing-list
- [oss-security] 20140616 CVE Request: iodine: authentication bypass by client mailing-list
- https://github.com/yarrick/iodine/blob/b715be5cf3978fbe589b03b09c9398d0d791f850/CHANGELOG
- DSA-2964 vendor-advisory