CVE catalog
CVE-2017-10807
jabberd2: CVE-2017-10807
- Severity
- High · CVSS 7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 2.81% · Oct 25, 2026
JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | jabberd2 | sid | 2.7.0-10 | fixed |
| Debian | jabberd2 | forky | 2.7.0-10 | fixed |
| Debian | jabberd2 | trixie | 2.7.0-8 | fixed |
| Debian | jabberd2 | bookworm | 2.7.0-4 | fixed |
| Suse | jabberd | manager proxy 3.0 | 2.6.1-4.6.1 | fixed |
| Suse | jabberd | manager server 3.0 | 2.6.1-4.6.1 | fixed |
| Suse | cobbler | manager server 3.1 | 2.6.6-5.3.1 | fixed |
| Suse | jabberd | manager server 3.1 | 2.6.1-3.3.1 | fixed |
| Suse | osad | manager server 3.1 | 5.11.80.3-2.3.1 | fixed |
| Suse | rhnpush | manager server 3.1 | 5.5.104.3-2.3.2 | fixed |
| Suse | salt-netapi-client | manager server 3.1 | 0.12.0-3.3.1 | fixed |
| Suse | smdba | manager server 3.1 | 1.5.8-0.2.3.1 | fixed |
| Suse | spacecmd | manager server 3.1 | 2.7.8.6-2.3.1 | fixed |
| Suse | spacewalk-backend | manager server 3.1 | 2.7.73.7-2.3.1 | fixed |
| Suse | spacewalk-branding | manager server 3.1 | 2.7.2.7-2.3.1 | fixed |
| Suse | spacewalk-certs-tools | manager server 3.1 | 2.7.0.7-2.3.1 | fixed |
| Suse | spacewalk-java | manager server 3.1 | 2.7.46.5-2.3.1 | fixed |
| Suse | spacewalk-search | manager server 3.1 | 2.7.3.2-2.3.4 | fixed |
| Suse | spacewalk-utils | manager server 3.1 | 2.7.10.5-2.3.1 | fixed |
| Suse | spacewalk-web | manager server 3.1 | 2.7.1.10-2.3.1 | fixed |
| Suse | susemanager | manager server 3.1 | 3.1.8-2.3.1 | fixed |
| Suse | susemanager-docs_en | manager server 3.1 | 3-10.3.1 | fixed |
| Suse | susemanager-schema | manager server 3.1 | 3.1.9-2.3.1 | fixed |
| Suse | susemanager-sync-data | manager server 3.1 | 3.1.6-2.3.1 | fixed |
| Suse | jabberd | manager proxy 3.1 | 2.6.1-3.3.1 | fixed |
| Suse | osad | manager proxy 3.1 | 5.11.80.3-2.3.1 | fixed |
| Suse | rhnpush | manager proxy 3.1 | 5.5.104.3-2.3.2 | fixed |
| Suse | spacewalk-backend | manager proxy 3.1 | 2.7.73.7-2.3.1 | fixed |
| Suse | spacewalk-certs-tools | manager proxy 3.1 | 2.7.0.7-2.3.1 | fixed |
| Suse | spacewalk-proxy | manager proxy 3.1 | 2.7.1.4-2.3.1 | fixed |
| Suse | spacewalk-web | manager proxy 3.1 | 2.7.1.10-2.3.1 | fixed |
| Suse | spacewalksd | manager proxy 3.1 | 5.0.26.3-2.3.1 | fixed |
| Suse | supportutils-plugin-susemanager-client | manager proxy 3.1 | 3.1.2-2.3.1 | fixed |
| Suse | zypp-plugin-spacewalk | manager proxy 3.1 | 0.9.16-2.3.1 | fixed |
| Ubuntu | jabberd2 | 16.04 | 2.3.3-3ubuntu1 | vulnerable |
| Ubuntu | jabberd2 | 16.04 | 2.3.4-1ubuntu1 | vulnerable |
| Ubuntu | jabberd2 | 16.04 | 2.3.4-1ubuntu2 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | jabberd2 | source | sid | 2.6.1-1 | not yet assigned | Not reported | [867032] |
| Debian | jabberd2 | source | forky | 2.6.1-1 | not yet assigned | Not reported | [867032] |
| Debian | jabberd2 | source | trixie | 2.6.1-1 | not yet assigned | Not reported | [867032] |
| Debian | jabberd2 | source | bookworm | 2.6.1-1 | not yet assigned | Not reported | [867032] |
| Suse | jabberd | rpm | manager proxy 3.0 | 2.6.1-4.6.1 | Not reported | SUSE-SU-2017:2267-1 | Not reported |
| Suse | jabberd | rpm | manager server 3.0 | 2.6.1-4.6.1 | Not reported | SUSE-SU-2017:2267-1 | Not reported |
| Suse | cobbler | rpm | manager server 3.1 | 2.6.6-5.3.1 | Not reported | SUSE-SU-2017:2257-1 | Not reported |
| Suse | jabberd | rpm | manager server 3.1 | 2.6.1-3.3.1 | Not reported | SUSE-SU-2017:2257-1 | Not reported |
| Suse | osad | rpm | manager server 3.1 | 5.11.80.3-2.3.1 | Not reported | SUSE-SU-2017:2257-1 | Not reported |
| Suse | rhnpush | rpm | manager server 3.1 | 5.5.104.3-2.3.2 | Not reported | SUSE-SU-2017:2257-1 | Not reported |
| Suse | salt-netapi-client | rpm | manager server 3.1 | 0.12.0-3.3.1 | Not reported | SUSE-SU-2017:2257-1 | Not reported |
| Suse | smdba | rpm | manager server 3.1 | 1.5.8-0.2.3.1 | Not reported | SUSE-SU-2017:2257-1 | Not reported |
| Suse | spacecmd | rpm | manager server 3.1 | 2.7.8.6-2.3.1 | Not reported | SUSE-SU-2017:2257-1 | Not reported |
| Suse | spacewalk-backend | rpm | manager server 3.1 | 2.7.73.7-2.3.1 | Not reported | SUSE-SU-2017:2257-1 | Not reported |
| Suse | spacewalk-branding | rpm | manager server 3.1 | 2.7.2.7-2.3.1 | Not reported | SUSE-SU-2017:2257-1 | Not reported |
| Suse | spacewalk-certs-tools | rpm | manager server 3.1 | 2.7.0.7-2.3.1 | Not reported | SUSE-SU-2017:2257-1 | Not reported |
| Suse | spacewalk-java | rpm | manager server 3.1 | 2.7.46.5-2.3.1 | Not reported | SUSE-SU-2017:2257-1 | Not reported |
| Suse | spacewalk-search | rpm | manager server 3.1 | 2.7.3.2-2.3.4 | Not reported | SUSE-SU-2017:2257-1 | Not reported |
| Suse | spacewalk-utils | rpm | manager server 3.1 | 2.7.10.5-2.3.1 | Not reported | SUSE-SU-2017:2257-1 | Not reported |
| Suse | spacewalk-web | rpm | manager server 3.1 | 2.7.1.10-2.3.1 | Not reported | SUSE-SU-2017:2257-1 | Not reported |
| Suse | susemanager | rpm | manager server 3.1 | 3.1.8-2.3.1 | Not reported | SUSE-SU-2017:2257-1 | Not reported |
| Suse | susemanager-docs_en | rpm | manager server 3.1 | 3-10.3.1 | Not reported | SUSE-SU-2017:2257-1 | Not reported |
| Suse | susemanager-schema | rpm | manager server 3.1 | 3.1.9-2.3.1 | Not reported | SUSE-SU-2017:2257-1 | Not reported |
| Suse | susemanager-sync-data | rpm | manager server 3.1 | 3.1.6-2.3.1 | Not reported | SUSE-SU-2017:2257-1 | Not reported |
| Suse | jabberd | rpm | manager proxy 3.1 | 2.6.1-3.3.1 | Not reported | SUSE-SU-2017:2266-1 | Not reported |
| Suse | osad | rpm | manager proxy 3.1 | 5.11.80.3-2.3.1 | Not reported | SUSE-SU-2017:2266-1 | Not reported |
| Suse | rhnpush | rpm | manager proxy 3.1 | 5.5.104.3-2.3.2 | Not reported | SUSE-SU-2017:2266-1 | Not reported |
| Suse | spacewalk-backend | rpm | manager proxy 3.1 | 2.7.73.7-2.3.1 | Not reported | SUSE-SU-2017:2266-1 | Not reported |
| Suse | spacewalk-certs-tools | rpm | manager proxy 3.1 | 2.7.0.7-2.3.1 | Not reported | SUSE-SU-2017:2266-1 | Not reported |
| Suse | spacewalk-proxy | rpm | manager proxy 3.1 | 2.7.1.4-2.3.1 | Not reported | SUSE-SU-2017:2266-1 | Not reported |
| Suse | spacewalk-web | rpm | manager proxy 3.1 | 2.7.1.10-2.3.1 | Not reported | SUSE-SU-2017:2266-1 | Not reported |
| Suse | spacewalksd | rpm | manager proxy 3.1 | 5.0.26.3-2.3.1 | Not reported | SUSE-SU-2017:2266-1 | Not reported |
| Suse | supportutils-plugin-susemanager-client | rpm | manager proxy 3.1 | 3.1.2-2.3.1 | Not reported | SUSE-SU-2017:2266-1 | Not reported |
| Suse | zypp-plugin-spacewalk | rpm | manager proxy 3.1 | 0.9.16-2.3.1 | Not reported | SUSE-SU-2017:2266-1 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
[Debian 13 (Trixie)]
- [jabberd2]Fixed
Details (2)
2.7.0-8· amd64 · trixieFixed · Fixed:
2.6.1-1dsa · jabberd2 · debian · 13
2.7.0-8· arm64 · trixieFixed · Fixed:
2.6.1-1dsa · jabberd2 · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2017_2257-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2017-10807]
- [https://osv.dev/vulnerability/DSA-3902-1]
- [https://osv.dev/vulnerability/SUSE-SU-2017:2257-1]
- [https://osv.dev/vulnerability/SUSE-SU-2017:2266-1]
- [https://osv.dev/vulnerability/SUSE-SU-2017:2267-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2017-10807]
- [https://security-tracker.debian.org/tracker/CVE-2017-10807]
- [https://security.access.redhat.com/data/csaf/v2/vex/2017/cve-2017-10807.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]