{"id":"CVE-2016-7143","details":"The m_authenticate function in modules/m_sasl.c in Charybdis before 3.5.3 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.","modified":"2026-07-08T12:41:46.369494Z","published":"2016-09-21T14:25:26.177Z","related":["openSUSE-SU-2024:10220-1","openSUSE-SU-2024:11392-1"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"}]},"references":[{"type":"WEB","url":"http://www.securityfocus.com/bid/92761"},{"type":"ADVISORY","url":"http://www.debian.org/security/2016/dsa-3661"},{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2016/09/04/3"},{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2016/09/05/8"},{"type":"ADVISORY","url":"https://github.com/charybdis-ircd/charybdis/blob/charybdis-3.5.3/NEWS.md"},{"type":"FIX","url":"https://github.com/charybdis-ircd/charybdis/commit/818a3fda944b26d4814132cee14cfda4ea4aa824"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/charybdis-ircd/charybdis","events":[{"introduced":"0"},{"last_affected":"96129f7d4dff82ba4daa70a0de1ae6c44213a74b"},{"fixed":"818a3fda944b26d4814132cee14cfda4ea4aa824"}],"database_specific":{"cpe":"cpe:2.3:a:charybdis_project:charybdis:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"3.5.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["charybdis-3.5.2","charybdis-3.5.1","charybdis-3.5.0","charybdis-3.5.0-rc1","charybdis-3.5.0-test1"],"database_specific":{"vanir_signatures":[{"id":"CVE-2016-7143-2b66f471","signature_type":"Line","signature_version":"v1","source":"https://github.com/charybdis-ircd/charybdis/commit/818a3fda944b26d4814132cee14cfda4ea4aa824","target":{"file":"modules/m_sasl.c"},"deprecated":false,"digest":{"line_hashes":["307977163491788888553282772178121197387","173380711908594219357427529785413226173","298527943946820592230202928672794915803"],"threshold":0.9}},{"target":{"file":"modules/m_sasl.c","function":"m_authenticate"},"deprecated":false,"digest":{"function_hash":"255452577363413129625900170026446147051","length":1835},"id":"CVE-2016-7143-f0f3bcd6","signature_type":"Function","signature_version":"v1","source":"https://github.com/charybdis-ircd/charybdis/commit/818a3fda944b26d4814132cee14cfda4ea4aa824"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-7143.json","vanir_signatures_modified":"2026-07-08T12:41:46Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}