Fedora Account System
Red Hat Associate
Red Hat Customer
The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.
Created attachment 2163171 [details] Upgrade epel9 to 6.2.7.1 (git format-patch) EPEL 9 still ships unrealircd-6.1.10-1.el9, which is affected by CVE-2026-114713 (6.0.0 up to and including 6.2.7). Upstream reports active exploitation attempts. Attached is a patch against the epel9 dist-git branch (made with git format-patch, apply with git am) that upgrades the package to 6.2.7.1. 6.2.7.1 fixes this CVE and 8 further security issues, and also CVE-2026-90668 (bug 2532935). Changes: - Upgrade to 6.2.7.1. - Upstream now signs releases with a new key, 36E6F65706E36B0937280299101001DAF48BB56D. The same fingerprint is in upstream git doc/KEYS (added 2024-11-18), on unrealircd.org and on keys.openpgp.org. The old key 1D2D2B03... has expired. - The crypto-policy and unrealircdctl patches are rebased to 6.2.7.1. The unrealircdctl patch also fixes a use-after-free in unrealircdctl_permdrop(): pwd was freed before pwd->pw_gid and pwd->pw_uid were read. - The GeoIP patch is dropped. In 6.2 no GeoIP engine is loaded unless the package is built with --enable-mmdb, so nothing is downloaded from geoip.unrealircd.org by default. - The maxmind subpackage is dropped, because upstream removed geoip_maxmind in 6.2 (it is replaced by the built-in geoip_mmdb). "Obsoletes: unrealircd-maxmind < 6.2" is added so upgrades don't break. - /etc/pki/unrealircd/tls.cnf (new in 6.2) is packaged. New sources still need "fedpkg new-sources". The upstream URLs are in the spec, and the SHA512 sums are in the sources file in the patch: unrealircd-6.2.7.1.tar.gz, unrealircd-6.2.7.1.tar.gz.asc, gpgkey-36E6F65706E36B0937280299101001DAF48BB56D.gpg Tested in a rockylinux:9 container with EPEL and CRB: - rpmbuild --rebuild succeeds. - Upgrading from unrealircd-6.1.10-1.el9 + unrealircd-maxmind-6.1.10-1.el9 works, and maxmind is obsoleted cleanly. - The server starts with ciphers "PROFILE=SYSTEM". - With labeled-response enabled, "@label=ok123 PING" gets its label back and "@label=x\sKILL\stester PING" has the label dropped, so the fix is active. This is a version jump within EL9, justified by the security fix under the EPEL incompatible upgrades policy. I'm happy to turn this into a dist-git PR, or to send the epel-devel announcement, if that helps.
Created attachment 2163172 [details] Specfile Used spec file