This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============1268473264089221938==
Content-Language: en-US
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="------------QHJGI4wXJ2ERgkcU5RDE85cV"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--------------QHJGI4wXJ2ERgkcU5RDE85cV
Content-Type: multipart/mixed;
 boundary="------------RffSOzqf95LGgIlB5jONNMXE";
 protected-headers="v1"
From: Bruce Cable <bruce.cable@canonical.com>
Reply-To: Ubuntu Security <security@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com
Message-ID: <87db02bb-bbc2-4562-9747-1b157486bbdb@canonical.com>
Subject: [USN-7405-1] InspIRCd vulnerabilities

--------------RffSOzqf95LGgIlB5jONNMXE
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: base64

==========================================================================
Ubuntu Security Notice USN-7405-1
April 02, 2025

inspircd vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in InspIRCd.

Software Description:
- inspircd: Modular IRCd written in C++

Details:

It was discovered that InspIRCd did not correctly handle certificate
fingerprints, which could lead to spoofing. A remote attacker could
possibly use this issue to bypass authentication. This issue only affected
Ubuntu 16.04 LTS. (CVE-2016-7142)

It was discovered that InspIRCd did not correctly handle certain memory
operations, which could lead to a NULL pointer dereference. A remote
attacker could possibly use this issue to cause a denial of service. This
issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
(CVE-2019-20917)

It was discovered that InspIRCd did not correctly handle certain memory
operations, which could lead to a use-after-free. A remote attacker could
possibly use this issue to cause a denial of service. (CVE-2020-25269)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS
   inspircd                        3.4.0-2ubuntu1+esm1
                                   Available with Ubuntu Pro

Ubuntu 18.04 LTS
   inspircd                        2.0.24-1ubuntu1+esm1
                                   Available with Ubuntu Pro

Ubuntu 16.04 LTS
   inspircd                        2.0.20-5ubuntu0.1~esm1
                                   Available with Ubuntu Pro

After a standard system update you need to restart InspIRCd to make
all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-7405-1
   CVE-2016-7142, CVE-2019-20917, CVE-2020-25269

--------------RffSOzqf95LGgIlB5jONNMXE--

--------------QHJGI4wXJ2ERgkcU5RDE85cV
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature.asc"

-----BEGIN PGP SIGNATURE-----

wsD5BAABCAAjFiEEkd98mdFcnQdP7vQkuGrtzot7pOcFAmfs1ycFAwAAAAAACgkQuGrtzot7pOdZ
aQwAlv1vLYYD9ZnbgI8pTsKT1tnrAOg6uieAOve5bi5Trv03qDqL0DQYYse2evKrVgU0GSknw0hy
YldC9a5i15q0x8PeOBafVX2qhz1RtPGsBbB8WwnUDPfryg2IfQrLCfhZsWfw1xkPXR5p+dOH99Rr
1G95lcvVtxkFVmdxil2Hc2JLG5HmqIXaQArp1KBNbtDPl04CkQYRLjb8h8PofE4Uol26+CjF+/xo
ya4H30jrSASdUA7L5kYE5BLz0vRKpmcaiXm6fjKROfJ4xXqFMVMgJGecA9u7QV91zLjV6Oqc/+Wh
4IXGAb6oDQz9ezz9nh9zqrWBUx7RKTl3kAqWf1lXXt8ZKd9SUCyc6CIKIIrqWw3aAaBwCjxYggz9
vEDeZQoC1jU9/LQ8TftN1MGLJ5i/a3uy1L4ulJ8YsG8QO/SClLrX2kOTDhzB2GTgiijwdn/1OLVT
Y2Qqaqhn9TAvJELrOpPRjsx1ToXK7/RbLyolmLDMqwdGE1yrrzSr2ehC1fje
=xflI
-----END PGP SIGNATURE-----

--------------QHJGI4wXJ2ERgkcU5RDE85cV--


--===============1268473264089221938==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

Cg==

--===============1268473264089221938==--