CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
AI Score
Confidence
Low
EPSS
Percentile
76.0%
Irssi before 0.8.15, when SSL is used, does not verify that the server hostname matches a domain name in the subject’s Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate, which allows man-in-the-middle attackers to spoof IRC servers via an arbitrary certificate.
Vendor | Product | Version | CPE |
---|---|---|---|
irssi | irssi | * | cpe:2.3:a:irssi:irssi:*:rc1:*:*:*:*:*:* |
irssi | irssi | 0.8.0 | cpe:2.3:a:irssi:irssi:0.8.0:*:*:*:*:*:*:* |
irssi | irssi | 0.8.1 | cpe:2.3:a:irssi:irssi:0.8.1:*:*:*:*:*:*:* |
irssi | irssi | 0.8.2 | cpe:2.3:a:irssi:irssi:0.8.2:*:*:*:*:*:*:* |
irssi | irssi | 0.8.3 | cpe:2.3:a:irssi:irssi:0.8.3:*:*:*:*:*:*:* |
irssi | irssi | 0.8.4 | cpe:2.3:a:irssi:irssi:0.8.4:*:*:*:*:*:*:* |
irssi | irssi | 0.8.5 | cpe:2.3:a:irssi:irssi:0.8.5:*:*:*:*:*:*:* |
irssi | irssi | 0.8.6 | cpe:2.3:a:irssi:irssi:0.8.6:*:*:*:*:*:*:* |
irssi | irssi | 0.8.7 | cpe:2.3:a:irssi:irssi:0.8.7:*:*:*:*:*:*:* |
irssi | irssi | 0.8.8 | cpe:2.3:a:irssi:irssi:0.8.8:*:*:*:*:*:*:* |
github.com/ensc/irssi-proxy/commit/85bbc05b21678e80423815d2ef1dfe26208491ab
irssi.org/news
irssi.org/news/ChangeLog
lists.fedoraproject.org/pipermail/package-announce/2010-May/041054.html
lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html
marc.info/?l=oss-security&m=127098845125270&w=2
marc.info/?l=oss-security&m=127110132019166&w=2
marc.info/?l=oss-security&m=127116251220784&w=2
marc.info/?l=oss-security&m=127119240204394&w=2
secunia.com/advisories/39365
secunia.com/advisories/39620
secunia.com/advisories/39797
slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.497301
www.ubuntu.com/usn/USN-929-1
www.vupen.com/english/advisories/2010/0856
www.vupen.com/english/advisories/2010/0987
www.vupen.com/english/advisories/2010/1107
www.vupen.com/english/advisories/2010/1110
exchange.xforce.ibmcloud.com/vulnerabilities/57790