CVE-2017-8342

HIGH8.1EPSS 0.41%

radicale - security update

Published: 5/13/2022Modified: 4/28/2026

Description

Radicale before 1.1.2 and 2.x before 2.0.0rc2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method.

Affected packages (5)

Debian/radicalefrom 0, < 1.1.1+20160115-4
Debian/radicalefrom 0, < 0.9-1+deb8u2
Debian/radicalefrom 0, < 0.7-1.1+deb7u2
PyPI/radicalefrom 0, < 1.1.2
PyPI/radicalefrom 0, < 190b1dd795f0c552a4992445a231da760211183b, < 059ba8dec1f22ccbeab837e288b3833a099cee2d | from 0, < 1.1.2

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References (10)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2017-8342
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2017-8342
PATCHhttps://github.com/Kozea/Radicale
PATCHhttps://pypi.org/project/radicale
WEBhttps://bugs.debian.org/861514
WEBhttps://github.com/Kozea/Radicale/blob/1.1.2/NEWS.rst
WEBhttps://github.com/Kozea/Radicale/commit/059ba8dec1f22ccbeab837e288b3833a099cee2d
WEBhttps://github.com/Kozea/Radicale/commit/190b1dd795f0c552a4992445a231da760211183b
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/radicale/PYSEC-2017-102.yaml
WEBhttps://lists.debian.org/debian-lts-announce/2020/04/msg00019.html