Description
The m_authenticate function in modules/m_sasl.c in Charybdis before 3.5.3 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | charybdis | 3.4.2-5+deb8u2 | DSA-3661-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | charybdis | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | charybdis | 3.4.2-3ubuntu0.1~esm1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | charybdis | 3.5.3-2.1 | openSUSE-SU-2024:10220-1 |
| openSUSE Tumbleweed | solanum | 0~ch448-1.4 | openSUSE-SU-2024:11392-1 |
Advisories 3
- DSA-3661-1 charybdis - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10220-1 charybdis-3.5.3-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11392-1 solanum-0~ch448-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/charybdis-ircd/charybdis/commit/818a3fda944b26d4814132cee14cfda4ea4aa824
- DSA-3661 vendor-advisory
- https://github.com/charybdis-ircd/charybdis/blob/charybdis-3.5.3/NEWS.md
- 92761 vdb-entry
- [oss-security] 20160905 Re: CVE ID request: certificate spoofing through crafted SASL message in inspircd, charybdis mailing-list
- [oss-security] 20160904 CVE ID request: certificate spoofing through crafted SASL message in inspircd, charybdis mailing-list