{"id":"CVE-2022-24976","aliases":["DEBIAN-CVE-2022-24976","EUVD-2022-29726","GHSA-3fv4-6wvg-x83x","UBUNTU-CVE-2022-24976","openSUSE-SU-2022:10018-1","openSUSE-SU-2022:10019-1","openSUSE-SU-2024:11848-1"],"status":"published","title":"Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication...","description":"Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01812,"percentile":0.78792,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2022-02-13T06:20:02Z","modified":"2026-10-28T10:25:58Z","fixes":[{"ecosystem":"Debian:12","package":"atheme-services","fixed_in":["7.2.12-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"atheme-services","fixed_in":["7.2.12-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"atheme-services","fixed_in":["7.2.12-1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP3","package":"atheme","fixed_in":["7.2.12-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"atheme","fixed_in":["7.2.12-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP4","package":"atheme","fixed_in":["7.2.12-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"atheme","fixed_in":["7.2.12-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"atheme","fixed_in":["7.2.12-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"atheme-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.12-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"atheme-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.12-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"atheme-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.12-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"atheme-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.11-2","6.0.11-2+deb8u1build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"atheme-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2.9-1","7.2.9-1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"atheme-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2.9-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"atheme-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2.11-1","7.2.11-1build1","7.2.12-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"atheme-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2.12-1","7.2.12-1build1","7.2.12-1build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"atheme-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2.12-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"atheme-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2.12-2","7.2.12-2.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"atheme-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2.12-2"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"atheme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.12-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"atheme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.12-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"atheme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.12-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"atheme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.12-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"atheme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.12-2.1"}]}]}],"products":[{"vendor":"atheme","product":"atheme"}],"references":[{"url":"https://www.openwall.com/lists/oss-security/2022/01/30/4","tags":["x_refsource_MISC","x_transferred","Exploit","Mailing List","Third Party Advisory","web","report"]},{"url":"https://github.com/atheme/atheme/commit/4e664c75d0b280a052eb8b5e81aa41944e593c52","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/atheme/atheme/compare/v7.2.11...v7.2.12","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24976","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3fv4-6wvg-x83x"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24976.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-24976","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-24976","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24976","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GECJKZJVJ27JRBFZBJQLJBGGU22CP24T/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1174075","tags":["report"]},{"url":"https://bugzilla.suse.com/1195989","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24976","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MTX2GANIBYWOEW6H7AVAQRFPE4Y44SXK/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-24976","description":"Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.","status":"published","published":"2022-02-13T06:20:02Z","modified":"2024-08-03T04:29:01.643Z","updated_at":"2026-11-02T14:34:34.576287Z"}],"euvd":[{"id":"EUVD-2022-29726","description":"Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.","status":"published","published":"2022-02-13T06:20:02Z","modified":"2024-08-03T04:29:01Z","updated_at":"2026-11-03T03:25:48.512748Z"}],"ghsa":[{"id":"GHSA-3fv4-6wvg-x83x","title":"Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication...","description":"Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.","status":"published","published":"2022-02-15T00:02:47Z","modified":"2023-02-03T05:05:54Z","cwes":["CWE-287"],"updated_at":"2026-11-02T14:53:48.81294Z"}],"nvd":[{"id":"CVE-2022-24976","description":"Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.","status":"published","published":"2022-02-14T12:15:27.68Z","modified":"2026-06-17T04:32:53.223Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:07:12.155838Z"}],"osv":[{"id":"DEBIAN-CVE-2022-24976","description":"Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.","status":"published","published":"2022-02-14T12:15:27.68Z","modified":"2026-11-03T08:02:45.5756211Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"UBUNTU-CVE-2022-24976","description":"Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.","status":"published","published":"2022-02-14T12:15:00Z","modified":"2026-10-17T12:55:57.004874814Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"CVE-2022-24976","description":"Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.","status":"published","published":"2022-02-13T06:20:02Z","modified":"2026-10-28T10:25:58.607097075Z","updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"openSUSE-SU-2022:10018-1","title":"Security update for atheme","description":"This update for atheme fixes the following issues:\n\natheme was updated to release 7.2.12:\n\n* CVE-2022-24976: Fixed General authentication bypass in Atheme IRC services with InspIRCd 3 [boo#1195989]\n* Track SASL login EID\n\nUpdate to release 7.2.11\n\n* Add a preliminary Turkish translation\n* Add HMAC-MD5 verify-only support to crypto/pbkdf2v2\n* modules/chanserv/akick: fix unload crash with akicks that\n  have timeouts\n* modules/nickserv/multimark: use IRC case canonicalisation\n  for restored nicks\n* modules/nickserv/multimark: forbid unloading due to the\n  potential for data loss\n* CA_ constants: include CA_EXEMPT (+e) where appropriate\n\nUpdate to new upstream release 7.2.10.r2\n\n* Fix potential NULL dereference in modules/crypto/posix.\n* Bump E-Mail address maximum length to 254 characters.\n* Use flags setter information in modules/chanserv/access \u0026\n  modules/chanserv/flags.\n* Fix issue where modules/misc/httpd was not closing its\n  listening socket on deinit.\n* Fix GroupServ data loss issue when a group was the founder of\n  another group.\n","status":"published","published":"2022-06-20T10:32:27Z","modified":"2026-02-04T02:15:51.632749Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:10019-1","title":"Security update for atheme","description":"This update for atheme fixes the following issues:\n\natheme was updated to release 7.2.12:\n\n* CVE-2022-24976: Fixed General authentication bypass in Atheme IRC services with InspIRCd 3  [boo#1195989]\n* Track SASL login EID\n","status":"published","published":"2022-06-20T12:51:17Z","modified":"2026-02-04T03:53:12.140036Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11848-1","title":"atheme-7.2.12-2.1 on GA media","description":"These are all security issues fixed in the atheme-7.2.12-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:26:47.405193Z","updated_at":"2026-11-02T16:58:35.485255Z"}]}}