git: d79a31297d77 - main - security/vuxml: Document ejabberd vulnerabilities
Ashish SHUKLA <[email protected]>
| Newsgroups | gmane.os.freebsd.devel.cvs.ports |
|---|---|
| Message-ID | <6a6d4bfa.1f356.12ac2d86__34387.4536616326$1785547798$gmane$org@gitrepo.freebsd.org> |
The branch main has been updated by ashish: URL: https://cgit.FreeBSD.org/ports/commit/?id=d79a31297d77d0fd4c06c54f5ffbd5f3292323d6 commit d79a31297d77d0fd4c06c54f5ffbd5f3292323d6 Author: Ashish SHUKLA <[email protected]> AuthorDate: 2026-08-01 01:26:55 +0000 Commit: Ashish SHUKLA <[email protected]> CommitDate: 2026-08-01 01:28:36 +0000 security/vuxml: Document ejabberd vulnerabilities --- security/vuxml/vuln/2026.xml | 60 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) diff --git a/security/vuxml/vuln/2026.xml b/security/vuxml/vuln/2026.xml index 9f363464a26d..ffa19afa6445 100644 --- a/security/vuxml/vuln/2026.xml +++ b/security/vuxml/vuln/2026.xml @@ -1,3 +1,63 @@ + <vuln vid="ca42379d-8d45-11f1-a129-901b0e9408dc"> + <topic>ejabberd -- Multiple security vulnerabilities</topic> + <affects> + <package> + <name>ejabberd</name> + <range><lt>26.07</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>ejabberd team reports:</p> + <blockquote cite="https://www.process-one.net/blog/ejabberd-26-07/#security"> + <ul> + <li>It's possible to craft PLAIN auth request and + authenticate as one user, but then open session for + different one.</li> + <li>mod_caps persistent cache can be poisoned by using + legacy version requests.This cache was only used to + determine list of nodes that should trigger notifications + in PubSub presence-based delivery.</li> + <li>SQL injection in mod_pubsub handling of paging + requests.</li> + <li>Possible atom exhaustion that can be triggered by + issuing REST requests to mod_http_api.</li> + <li>It was possible to make ejabberd send redirect + response for OAuth requests to unvetted url. This required + enabling ejabberd to act as OAuth provider (by adding + request handler for ejabberd_oauth in http listener). As + part of this fix we changed oauth_client_id_check default + value to db.</li> + <li>using ejabberd as OAuth provider will be only allowed + by clients</li> + <li>that were previously registered with + oauth_add_client_password or oauth_add_client_implicit + commands.</li> + <li>Tokens generated by mod_bosh, captcha, mod_auth_fast, + mod_http_upload and mod_invites used not cryptographically + strong random number generators.</li> + <li>Files server by mod_http_upload didn't have XSS + prevention headers.</li> + <li>Issues in authentication of SIP requests.</li> + <li>Request to web_admin were lacking CSRF + protection.</li> + <li>It was possible to skip captcha verification in + mod_register_web.</li> + <li>mod_conversejs allowed putting unescaped value from + url in page content.</li> + </ul> + </blockquote> + </body> + </description> + <references> + <url>https://www.process-one.net/blog/ejabberd-26-07/#security</url> + </references> + <dates> + <discovery>2026-07-30</discovery> + <entry>2026-08-01</entry> + </dates> + </vuln> + <vuln vid="1976b049-8ccc-11f1-b333-901b0edee044"> <topic>py-mkdocs-material -- DOM XSS vulnerability</topic> <affects>