Bug 2568818 (CVE-2026-114713)
| Summary: | CVE-2026-114713 unrealircd: unrealircd: Command injection via unescaped message tag | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> | ||||||
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> | ||||||
| Status: | NEW --- | QA Contact: | |||||||
| Severity: | high | Docs Contact: | |||||||
| Priority: | high | ||||||||
| Version: | unspecified | CC: | terence | ||||||
| Target Milestone: | --- | Keywords: | Security | ||||||
| Target Release: | --- | ||||||||
| Hardware: | All | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | Doc Type: | --- | |||||||
| Doc Text: |
A flaw was found in UnrealIRCd. The labeled-response module fails to properly escape the label message tag when echoing it into replies. A connected user on an IRC (Internet Relay Chat) network with linked servers can exploit this issue to inject server-to-server commands that are executed with server authority, compromising network integrity.
|
Story Points: | --- | ||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | Type: | --- | |||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Bug Depends On: | 2569202, 2569203 | ||||||||
| Bug Blocks: | |||||||||
| Attachments: |
|
||||||||
|
Description
OSIDB Bzimport
2026-11-08 02:48:44 UTC
Created attachment 2163171 [details] Upgrade epel9 to 6.2.7.1 (git format-patch) EPEL 9 still ships unrealircd-6.1.10-1.el9, which is affected by CVE-2026-114713 (6.0.0 up to and including 6.2.7). Upstream reports active exploitation attempts. Attached is a patch against the epel9 dist-git branch (made with git format-patch, apply with git am) that upgrades the package to 6.2.7.1. 6.2.7.1 fixes this CVE and 8 further security issues, and also CVE-2026-90668 (bug 2532935). Changes: - Upgrade to 6.2.7.1. - Upstream now signs releases with a new key, 36E6F65706E36B0937280299101001DAF48BB56D. The same fingerprint is in upstream git doc/KEYS (added 2024-11-18), on unrealircd.org and on keys.openpgp.org. The old key 1D2D2B03... has expired. - The crypto-policy and unrealircdctl patches are rebased to 6.2.7.1. The unrealircdctl patch also fixes a use-after-free in unrealircdctl_permdrop(): pwd was freed before pwd->pw_gid and pwd->pw_uid were read. - The GeoIP patch is dropped. In 6.2 no GeoIP engine is loaded unless the package is built with --enable-mmdb, so nothing is downloaded from geoip.unrealircd.org by default. - The maxmind subpackage is dropped, because upstream removed geoip_maxmind in 6.2 (it is replaced by the built-in geoip_mmdb). "Obsoletes: unrealircd-maxmind < 6.2" is added so upgrades don't break. - /etc/pki/unrealircd/tls.cnf (new in 6.2) is packaged. New sources still need "fedpkg new-sources". The upstream URLs are in the spec, and the SHA512 sums are in the sources file in the patch: unrealircd-6.2.7.1.tar.gz, unrealircd-6.2.7.1.tar.gz.asc, gpgkey-36E6F65706E36B0937280299101001DAF48BB56D.gpg Tested in a rockylinux:9 container with EPEL and CRB: - rpmbuild --rebuild succeeds. - Upgrading from unrealircd-6.1.10-1.el9 + unrealircd-maxmind-6.1.10-1.el9 works, and maxmind is obsoleted cleanly. - The server starts with ciphers "PROFILE=SYSTEM". - With labeled-response enabled, "@label=ok123 PING" gets its label back and "@label=x\sKILL\stester PING" has the label dropped, so the fix is active. This is a version jump within EL9, justified by the security fix under the EPEL incompatible upgrades policy. I'm happy to turn this into a dist-git PR, or to send the epel-devel announcement, if that helps. Created attachment 2163172 [details]
Specfile
Used spec file
|