CVE-2012-3525
Fixed in a distro release EPSS 2%
s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.
Products: jabber2 jabberd2, jabberd2
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | jabberd2 | 2.2.17-1 |
| Debian 13 | jabberd2 | 2.2.17-1 |
| Debian 14 | jabberd2 | 2.2.17-1 |
| Red Hat network proxy 5.5 | jabberd | 0:2.2.8-20.el5sat |
| Red Hat network proxy 5.5 | jabberd | 0:2.2.8-20.el6sat |
| Red Hat network proxy 5.5 | jabberd-debuginfo | 0:2.2.8-20.el5sat |
| Red Hat network proxy 5.5 | jabberd-debuginfo | 0:2.2.8-20.el6sat |
| Red Hat network satellite 5.5 | jabberd | 0:2.2.8-20.el5sat |
| Red Hat network satellite 5.5 | jabberd | 0:2.2.8-20.el6sat |
| Red Hat network satellite 5.5 | jabberd-debuginfo | 0:2.2.8-20.el5sat |
| Red Hat network satellite 5.5 | jabberd-debuginfo | 0:2.2.8-20.el6sat |