CVE-2022-24976
Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication...
Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.
- Record
CVE-2022-24976- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.
- Record
CVE-2022-24976- Updated
- 2026-11-02
EUVDEUVD-2022-29726 No score
Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.
- Record
EUVD-2022-29726- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3fv4-6wvg-x83x No score
Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication...
Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.
- Record
GHSA-3fv4-6wvg-x83x- Weakness
- CWE-287
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-24976
Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.
- Record
DEBIAN-CVE-2022-24976- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
OSVUBUNTU-CVE-2022-24976
Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.
- Record
UBUNTU-CVE-2022-24976- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSV No score
Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.
- Record
CVE-2022-24976- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:10018-1 No score
Security update for atheme
This update for atheme fixes the following issues:
atheme was updated to release 7.2.12:
- CVE-2022-24976: Fixed General authentication bypass in Atheme IRC services with InspIRCd 3 [boo#1195989]
- Track SASL login EID
Update to release 7.2.11
- Add a preliminary Turkish translation
- Add HMAC-MD5 verify-only support to crypto/pbkdf2v2
- modules/chanserv/akick: fix unload crash with akicks that have timeouts
- modules/nickserv/multimark: use IRC case canonicalisation for restored nicks
- modules/nickserv/multimark: forbid unloading due to the potential for data loss
- CA_ constants: include CA_EXEMPT (+e) where appropriate
Update to new upstream release 7.2.10.r2
- Fix potential NULL dereference in modules/crypto/posix.
- Bump E-Mail address maximum length to 254 characters.
- Use flags setter information in modules/chanserv/access & modules/chanserv/flags.
- Fix issue where modules/misc/httpd was not closing its listening socket on deinit.
- Fix GroupServ data loss issue when a group was the founder of another group.
- Record
openSUSE-SU-2022:10018-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:10019-1 No score
Security update for atheme
This update for atheme fixes the following issues:
atheme was updated to release 7.2.12:
- CVE-2022-24976: Fixed General authentication bypass in Atheme IRC services with InspIRCd 3 [boo#1195989]
- Track SASL login EID
- Record
openSUSE-SU-2022:10019-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11848-1 No score
atheme-7.2.12-2.1 on GA media
These are all security issues fixed in the atheme-7.2.12-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11848-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
atheme-servicesDebian:12 |
before 7.2.12-1 | 7.2.12-1 |
atheme-servicesDebian:13 |
before 7.2.12-1 | 7.2.12-1 |
atheme-servicesDebian:14 |
before 7.2.12-1 | 7.2.12-1 |
atheme-servicesUbuntu:16.04:LTS |
All versions, plus listed versions 6.0.11-26.0.11-2+deb8u1build0.16.04.1 |
None known |
atheme-servicesUbuntu:18.04:LTS |
All versions, plus listed versions 7.2.9-17.2.9-1build1 |
None known |
atheme-servicesUbuntu:20.04:LTS |
All versions, plus listed versions 7.2.9-3 |
None known |
atheme-servicesUbuntu:22.04:LTS |
All versions, plus listed versions 7.2.11-17.2.11-1build17.2.12-1 |
None known |
atheme-servicesUbuntu:24.04:LTS |
All versions, plus listed versions 7.2.12-17.2.12-1build17.2.12-1build2 |
None known |
atheme-servicesUbuntu:25.10 |
All versions, plus listed versions 7.2.12-2 |
None known |
atheme-servicesUbuntu:26.10 |
All versions, plus listed versions 7.2.12-27.2.12-2.1ubuntu1 |
None known |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
atheme-servicesUbuntu:26.04:LTS |
All versions, plus listed versions 7.2.12-2 |
None known |
athemeSUSE:Package Hub 15 SP3 |
before 7.2.12-bp153.2.3.1 | 7.2.12-bp153.2.3.1 |
athemeopenSUSE:Leap 15.3 |
before 7.2.12-bp153.2.3.1 | 7.2.12-bp153.2.3.1 |
athemeSUSE:Package Hub 15 SP4 |
before 7.2.12-bp154.2.3.1 | 7.2.12-bp154.2.3.1 |
athemeopenSUSE:Leap 15.4 |
before 7.2.12-bp154.2.3.1 | 7.2.12-bp154.2.3.1 |
athemeopenSUSE:Tumbleweed |
before 7.2.12-2.1 | 7.2.12-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-24976 is a critical vulnerability (CVSS 9.1) in Atheme, published February 13, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.81%, the 78th percentile. Fixed in atheme-services 7.2.12-1.
References
openwall.com/lists/oss-security/2022/01/30/4
github.com/atheme/atheme/commit/4e664c75d0b280a052eb8b5e81aa41944e593c52
nvd.nist.gov/vuln/detail/CVE-2022-24976
Show 8 moreShow less
security-tracker.debian.org/tracker/CVE-2022-24976
ubuntu.com/security/CVE-2022-24976
cve.org/CVERecord?id=CVE-2022-24976
lists.opensuse.org/archives/list/[email protected]/thread/GECJKZJVJ27JRBFZBJQLJBGGU22CP24T
bugzilla.suse.com/1174075
suse.com/security/cve/CVE-2022-24976