An issue in provider/libserver/ECKrbAuth.cpp of Kopano-Core v11.0.2.51 contains an issue which allows attackers to authenticate even if the user account or password is expired. References: - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26562 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1016973 - https://jira.kopano.io/browse/KC-2021 - https://github.com/Kopano-dev/kopano-core/blob/master/provider/libserver/ECKrbAuth.cpp#L137
The security flaw was introduced between Zarafa 6.30.0 RC 1e (Subversion Revision 14802) and 6.30.8 Final (Subversion Revision 18345) in provider/libserver/ECPamAuth.cpp and also affects Kopano Core <= 11.0.2.51 in provider/libserver/ECKrbAuth.cpp.
FEDORA-EPEL-2023-342b96903b has been submitted as an update to Fedora EPEL 7. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-342b96903b
FEDORA-EPEL-2023-342b96903b has been pushed to the Fedora EPEL 7 testing repository. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-342b96903b See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-EPEL-2023-342b96903b has been pushed to the Fedora EPEL 7 stable repository. If problem still persists, please make note of it in this bug report.