PatchTheCVEejabberd vulnerabilities and fixes
Recent CVEs affecting ejabberd, with upgrade or downgrade steps. 3 tracked.
ejabberd has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2014-10-25. Highest priority: CVE-2014-8760 (score 35/100).
- CVE-2014-8760 MEDIUM 5.0 UPGRADE ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes c
- CVE-2013-6169 MEDIUM 4.3 UPGRADE The TLS driver in ejabberd before 2.1.12 supports (1) SSLv2 and (2) weak SSL ciphers, which makes it easier fo
- CVE-2011-4320 MEDIUM 4.0 DOWNGRADE The mod_pubsub module (mod_pubsub.erl) in ejabberd 2.1.8 and 3.0.0-alpha-3 allows remote authenticated users t
FAQ
How do I fix ejabberd vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is ejabberd being exploited right now?
None of the tracked ejabberd CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which ejabberd CVE should I patch first?
CVE-2014-8760 currently ranks highest (35/100): ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes c.