{"id":"CVE-2013-7239","aliases":["DEBIAN-CVE-2013-7239","DSA-2832-1","EUVD-2013-7018","GHSA-v5qw-pp2p-cvpr","MGASA-2014-0018","SUSE-SU-2018:0778-1","SUSE-SU-2018:0807-1","openSUSE-SU-2024:10021-1"],"status":"published","title":"memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid...","description":"memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.","severity":{"version":"2.0","score":4.8,"vector":"AV:A/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0118,"percentile":0.67903,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2014-01-01T00:00:00Z","modified":"2026-09-01T20:02:15Z","fixes":[{"ecosystem":"Debian:12","package":"memcached","fixed_in":["1.4.13-0.3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"memcached","fixed_in":["1.4.13-0.3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"memcached","fixed_in":["1.4.13-0.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.13-0.3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.13-0.3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.13-0.3"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-1+deb6u1"}]}],"versions":["1.4.5-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.13-0.2+deb7u1"}]}],"versions":["1.4.13-0.2"],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.17-1.mga3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.39-3.3.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.39-3.3.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.39-3.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.33-1.1"}]}],"bundled":9}],"products":[{"vendor":"memcached","product":"memcached"}],"references":[{"url":"http://www.securityfocus.com/bid/64559","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://code.google.com/p/memcached/wiki/ReleaseNotes1417","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://seclists.org/oss-sec/2013/q4/572","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2080-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2014/dsa-2832","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://secunia.com/advisories/56183","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7239"},{"url":"https://github.com/advisories/GHSA-v5qw-pp2p-cvpr"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-7239","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0018.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12156","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180778-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1007869","tags":["report"]},{"url":"https://bugzilla.suse.com/1007870","tags":["report"]},{"url":"https://bugzilla.suse.com/1007871","tags":["report"]},{"url":"https://bugzilla.suse.com/1056865","tags":["report"]},{"url":"https://bugzilla.suse.com/798458","tags":["report"]},{"url":"https://bugzilla.suse.com/817781","tags":["report"]},{"url":"https://bugzilla.suse.com/857188","tags":["report"]},{"url":"https://bugzilla.suse.com/858676","tags":["report"]},{"url":"https://bugzilla.suse.com/858677","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9951","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180807-1/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1494","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-7239","description":"memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.","status":"published","published":"2014-01-13T21:00:00Z","modified":"2024-08-06T18:01:20.106Z","updated_at":"2026-11-02T14:34:59.222149Z"}],"euvd":[{"id":"EUVD-2013-7018","description":"memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.","status":"published","published":"2014-01-13T21:00:00Z","modified":"2024-08-06T18:01:20Z","updated_at":"2026-11-03T01:56:23.942036Z"}],"ghsa":[{"id":"GHSA-v5qw-pp2p-cvpr","title":"memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid...","description":"memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.","status":"published","published":"2022-05-14T03:35:51Z","modified":"2023-02-02T05:07:56Z","cwes":["CWE-287"],"updated_at":"2026-11-02T14:52:37.555983Z"}],"nvd":[{"id":"CVE-2013-7239","description":"memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.","status":"published","published":"2014-01-13T21:55:05.23Z","modified":"2026-06-17T00:01:34.153Z","cvss":[{"version":"2.0","score":4.8,"vector":"AV:A/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:02:48.062712Z"}],"osv":[{"id":"CVE-2013-7239","description":"memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.","status":"published","published":"2014-01-13T21:55:05Z","modified":"2026-04-16T06:17:14.961142278Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2013-7239","description":"memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.","status":"published","published":"2014-01-13T21:55:05.23Z","modified":"2026-09-01T20:02:15.870337991Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DSA-2832-1","title":"memcached - several","status":"published","published":"2014-01-01T00:00:00Z","modified":"2026-03-09T01:21:42.235111Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0018","title":"Updated memcached package fixes multiple security vulnerabilities","description":"Updated memcached packages fix security vulnerability:\n\nIt was reported that SASL authentication could be bypassed due to a flaw\nrelated to the managment of the SASL authentication state. With a specially\ncrafted request, a remote attacker may be able to authenticate with invalid\nSASL credentials (CVE-2013-7239).\n\nMultiple issues in memcached before 1.4.17 which allow remote attackers to\ncause a denial of service by sending a request that causes a crash when\nmemcached is running in verbose mode (CVE-2013-0179, CVE-2013-7290,\nCVE-2013-7291).\n","status":"published","published":"2014-01-21T16:14:47Z","modified":"2026-04-16T06:25:58.664641846Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10021-1","title":"memcached-1.4.33-1.1 on GA media","description":"These are all security issues fixed in the memcached-1.4.33-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:05:40.069602Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2018:0778-1","title":"Security update for memcached","description":"This update for memcached fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2011-4971: remote DoS (bsc#817781).\n- CVE-2013-0179: DoS when printing out keys to be deleted in  verbose mode (bsc#798458).\n- CVE-2013-7239: SASL authentication allows wrong credentials to access memcache (bsc#857188).\n- CVE-2013-7290: remote DoS (segmentation fault) via a request to delete a key (bsc#858677).\n- CVE-2013-7291: remote DoS (crash) via a request that triggers 'unbounded key print' (bsc#858676).\n- CVE-2016-8704: Server append/prepend remote code execution (bsc#1007871).\n- CVE-2016-8705: Server update remote code execution (bsc#1007870).\n- CVE-2016-8706: Server ASL authentication remote code execution (bsc#1007869).\n- CVE-2017-9951: Heap-based buffer over-read in try_read_command function (incomplete fix for CVE-2016-8705) (bsc#1056865).\n","status":"published","published":"2018-03-22T13:15:48Z","modified":"2026-02-04T04:08:13.355547Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:0807-1","title":"Security update for memcached","description":"This update for memcached fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2011-4971: remote DoS (bsc#817781).\n- CVE-2013-0179: DoS when printing out keys to be deleted in  verbose mode (bsc#798458).\n- CVE-2013-7239: SASL authentication allows wrong credentials to access memcache (bsc#857188).\n- CVE-2013-7290: remote DoS (segmentation fault) via a request to delete a key (bsc#858677).\n- CVE-2013-7291: remote DoS (crash) via a request that triggers 'unbounded key print' (bsc#858676).\n- CVE-2016-8704: Server append/prepend remote code execution (bsc#1007871).\n- CVE-2016-8705: Server update remote code execution (bsc#1007870).\n- CVE-2016-8706: Server ASL authentication remote code execution (bsc#1007869).\n- CVE-2017-9951: Heap-based buffer over-read in try_read_command function (incomplete fix for CVE-2016-8705) (bsc#1056865).\n","status":"published","published":"2018-03-26T09:47:34Z","modified":"2026-02-04T03:07:58.794706Z","updated_at":"2026-11-02T15:53:44.594517Z"}]}}