Bugzilla – Bug 1227393
VUL-0: CVE-2024-39844: znc: arbitrary code embedded into the kick reason executed while kicking someone on a channel
Last modified: 2024-07-10 07:23:56 UTC
In ZNC before 1.9.1, remote code execution can occur in modtcl via a KICK. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-39844 https://seclists.org/oss-sec/2024/q3/23 https://github.com/znc/znc/commit/8cbf8d628174ddf23da680f3f117dc54da0eb06e https://www.cve.org/CVERecord?id=CVE-2024-39844 https://github.com/znc/znc/releases/tag/znc-1.9.1 https://wiki.znc.in/Category:ChangeLog https://wiki.znc.in/ChangeLog/1.9.1 http://www.openwall.com/lists/oss-security/2024/07/03/9
Patch: https://github.com/znc/znc/commit/8cbf8d628174ddf23da680f3f117dc54da0eb06e
SR#1185717 to devel project.
https://build.opensuse.org/request/show/1185807
(In reply to David Mulder from comment #4) > https://build.opensuse.org/request/show/1185807 What was wrong about my submission? :)
There are 3 submit requests now. I guess the package is popular. https://build.opensuse.org/request/show/1185717 https://build.opensuse.org/request/show/1185807 https://build.opensuse.org/request/show/1185826 Hint: someone should accept one so it can go to Factory ;)
(In reply to Michael Vetter from comment #5) > (In reply to David Mulder from comment #4) > > https://build.opensuse.org/request/show/1185807 > > What was wrong about my submission? :) Lol, the only thing wrong with it is I wasn't paying attention and thought you wanted me to do the submission.
(In reply to David Mulder from comment #7) > (In reply to Michael Vetter from comment #5) > > (In reply to David Mulder from comment #4) > > > https://build.opensuse.org/request/show/1185807 > > > > What was wrong about my submission? :) > > Lol, the only thing wrong with it is I wasn't paying attention and thought > you wanted me to do the submission. I see :) https://build.opensuse.org/request/show/1186187 was accepted to Factory. I think now Leap 15.6 also needs a submission.