Security Information / 2013 / Security Information -- DSA-2775-1 ejabberd

Debian Security Advisory

DSA-2775-1 ejabberd -- insecure SSL usage

Date Reported:

10 Oct 2013

Affected Packages:

ejabberd

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 722105.
In Mitre's CVE dictionary: CVE-2013-6169.

More information:

It was discovered that ejabberd, a Jabber/XMPP server, uses SSLv2 and weak ciphers for communication, which are considered insecure. The software offers no runtime configuration options to disable these. This update disables the use of SSLv2 and weak ciphers.

The updated package for Debian 7 (wheezy) also contains auxiliary bugfixes originally staged for the next stable point release.

For the oldstable distribution (squeeze), this problem has been fixed in version 2.1.5-3+squeeze2.

For the stable distribution (wheezy), this problem has been fixed in version 2.1.10-4+deb7u1.

For the testing distribution (jessie), and unstable distribution (sid), this problem will be fixed soon.

We recommend that you upgrade your ejabberd packages.