[USN-7405-1] InspIRCd vulnerabilities

-----BEGIN PGP SIGNATURE-----

wsD5BAABCAAjFiEEkd98mdFcnQdP7vQkuGrtzot7pOcFAmfs1ycFAwAAAAAACgkQuGrtzot7pOdZ
aQwAlv1vLYYD9ZnbgI8pTsKT1tnrAOg6uieAOve5bi5Trv03qDqL0DQYYse2evKrVgU0GSknw0hy
YldC9a5i15q0x8PeOBafVX2qhz1RtPGsBbB8WwnUDPfryg2IfQrLCfhZsWfw1xkPXR5p+dOH99Rr
1G95lcvVtxkFVmdxil2Hc2JLG5HmqIXaQArp1KBNbtDPl04CkQYRLjb8h8PofE4Uol26+CjF+/xo
ya4H30jrSASdUA7L5kYE5BLz0vRKpmcaiXm6fjKROfJ4xXqFMVMgJGecA9u7QV91zLjV6Oqc/+Wh
4IXGAb6oDQz9ezz9nh9zqrWBUx7RKTl3kAqWf1lXXt8ZKd9SUCyc6CIKIIrqWw3aAaBwCjxYggz9
vEDeZQoC1jU9/LQ8TftN1MGLJ5i/a3uy1L4ulJ8YsG8QO/SClLrX2kOTDhzB2GTgiijwdn/1OLVT
Y2Qqaqhn9TAvJELrOpPRjsx1ToXK7/RbLyolmLDMqwdGE1yrrzSr2ehC1fje
=xflI
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7405-1
April 02, 2025

inspircd vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in InspIRCd.

Software Description:
- inspircd: Modular IRCd written in C++

Details:

It was discovered that InspIRCd did not correctly handle certificate
fingerprints, which could lead to spoofing. A remote attacker could
possibly use this issue to bypass authentication. This issue only affected
Ubuntu 16.04 LTS. (CVE-2016-7142)

It was discovered that InspIRCd did not correctly handle certain memory
operations, which could lead to a NULL pointer dereference. A remote
attacker could possibly use this issue to cause a denial of service. This
issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
(CVE-2019-20917)

It was discovered that InspIRCd did not correctly handle certain memory
operations, which could lead to a use-after-free. A remote attacker could
possibly use this issue to cause a denial of service. (CVE-2020-25269)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS
  inspircd                        3.4.0-2ubuntu1+esm1
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  inspircd                        2.0.24-1ubuntu1+esm1
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  inspircd                        2.0.20-5ubuntu0.1~esm1
                                  Available with Ubuntu Pro

After a standard system update you need to restart InspIRCd to make
all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7405-1
  CVE-2016-7142, CVE-2019-20917, CVE-2020-25269