An issue in provider/libserver/ECKrbAuth.cpp of Kopano Core <= v11.0.2.51 contains an issue which allows attackers to authenticate even if the user account or password is expired. It also exists in the predecessor Zarafa Collaboration Platform (ZCP) in provider/libserver/ECPamAuth.cpp of Zarafa >= 6.30 (introduced between 6.30.0 RC1e and 6.30.8 final).
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade kopanocore | Mar 8, 2023 | Apr 1, 2022 |
| Ubuntu | — | Upgrade kopano-serverUpgrade kopano-utilsUpgrade kopano-dagentUpgrade kopano-libsUpgrade php-mapi (Ubuntu Pro)Upgrade kopano-archiver (Ubuntu Pro)Upgrade kopano-icalUpgrade python-mapi (Ubuntu Pro)Upgrade kopano-spoolerUpgrade kopano-utils (Ubuntu Pro)Upgrade kopano-archiverUpgrade kopano-monitor (Ubuntu Pro)Upgrade php-mapiUpgrade kopano-libs (Ubuntu Pro)Upgrade kopano-ical (Ubuntu Pro)Upgrade kopano-contactsUpgrade kopano-contacts (Ubuntu Pro)Upgrade kopano-gatewayUpgrade kopano-server (Ubuntu Pro)Upgrade kopano-dagent (Ubuntu Pro)Upgrade kopano-spooler (Ubuntu Pro)Upgrade kopano-monitorUpgrade python3-mapiUpgrade kopano-gateway (Ubuntu Pro) | Jul 9, 2024 | Apr 1, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub