https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 15:15:06 +0000 https://vulnerability.circl.lu/vuln/cve-2026-86219 <p><strong>Affected:</strong> Authen-SASL</p> <p>Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step.</p> <p>server_start generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns. server_step derives the expected digest from the client&#39;s own parameters, so a response verifies whenever its digest matches the nonce it carries. The count table it also checks is keyed on the client-supplied nonce and starts empty in each new server object, so a captured first response, carrying `nc=00000001`, passes that too. RFC 2831 defines the nonce in the response as the value the server sent in the preceding challenge.</p> <p>An attacker who observes one successful `qop=auth` exchange can replay the captured response against a later session for the same service, host, realm and user, and authenticate as that user without knowing the password.</p> <p><strong>Affected:</strong> Authen-SASL</p> <p>Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step.</p> <p>server_start generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns. server_step derives the expected digest from the client&#39;s own parameters, so a response verifies whenever its digest matches the nonce it carries. The count table it also checks is keyed on the client-supplied nonce and starts empty in each new server object, so a captured first response, carrying `nc=00000001`, passes that too. RFC 2831 defines the nonce in the response as the value the server sent in the preceding challenge.</p> <p>An attacker who observes one successful `qop=auth` exchange can replay the captured response against a later session for the same service, host, realm and user, and authenticate as that user without knowing the password.</p> https://vulnerability.circl.lu/vuln/cve-2026-86219 https://vulnerability.circl.lu/vuln/usn-8858-1 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: libauthen-sasl-perl, Ubuntu:Pro:16.04:LTS: libauthen-sasl-perl, Ubuntu:Pro:18.04:LTS: libauthen-sasl-perl, Ubuntu:Pro:20.04:LTS: libauthen-sasl-perl, Ubuntu:22.04:LTS: libauthen-sasl-perl, Ubuntu:24.04:LTS: libauthen-sasl-perl, Ubuntu:26.04:LTS: libauthen-sasl-perl</p> <p>It was discovered that Authen::SASL, a Perl authentication library, did not properly validate login attempts. An attacker could possibly use this issue to gain unauthorized access.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: libauthen-sasl-perl, Ubuntu:Pro:16.04:LTS: libauthen-sasl-perl, Ubuntu:Pro:18.04:LTS: libauthen-sasl-perl, Ubuntu:Pro:20.04:LTS: libauthen-sasl-perl, Ubuntu:22.04:LTS: libauthen-sasl-perl, Ubuntu:24.04:LTS: libauthen-sasl-perl, Ubuntu:26.04:LTS: libauthen-sasl-perl</p> <p>It was discovered that Authen::SASL, a Perl authentication library, did not properly validate login attempts. An attacker could possibly use this issue to gain unauthorized access.</p> https://vulnerability.circl.lu/vuln/usn-8858-1