SSL/TLS Support Vulnerability in Quassel Package
Summary
DEBIAN-CVE-2021-34825: Quassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a usable X.509 certificate is not found on the local system. Affects quassel versions < 1:0.14.0-1. Fixed in 1:0.14.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Quassel is a modern, distributed IRC client that allows users to stay connected to IRC networks seamlessly. It features a core and client architecture, enabling users to connect to their IRC sessions from multiple devices. The vulnerability in question affects versions of Quassel prior to 0.14.0, specifically when the '--require-ssl' option is enabled, leading to potential security risks.
Vulnerability Detail
The vulnerability arises when Quassel is launched with the '--require-ssl' option but fails to find a usable X.509 certificate on the local system. In such cases, Quassel starts without SSL or TLS support, exposing the communication to potential eavesdropping and man-in-the-middle attacks. This flaw can compromise the confidentiality and integrity of the data transmitted over the network.
How To Fix
Minimum fixed version
1:0.14.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade quasselTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the '--require-ssl' option when launching Quassel until they can update to the patched version. This can be done by simply not including the option in the launch command.
Conclusion
The Quassel package has a significant vulnerability related to SSL/TLS support when the '--require-ssl' option is enabled. Users are strongly advised to update to the patched version 1:0.14.0-1 to mitigate the risks associated with this vulnerability. Temporary workarounds are available, but updating is the best long-term solution.
See every vulnerability recorded for quassel →
FAQ
The vulnerability can lead to unencrypted communication, making it susceptible to interception and attacks.
You can check your version of Quassel by running 'quassel --version' in the terminal.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If you cannot update immediately, consider disabling the '--require-ssl' option as a temporary measure.
More information can be found in the official Debian CVE database or by visiting the Vulert playground at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for quassel.
