Alexey Sokolov 8cbf8d6281 Fix RCE vulnerability in modtcl ...

Remote attacker could execute arbitrary code embedded into the kick
reason while kicking someone on a channel.

To mitigate this for existing installations, simply unload the modtcl
module for every user, if it's loaded.
Note that only users with admin rights can load modtcl at all.

While at it, also escape the channel name.

Discovered by Johannes Kuhn (DasBrain)

Patch by https://github.com/glguy

CVE-2024-39844

2024-07-01 10:27:49 +01:00

..

data

Fix casing on traffic info table

2024-04-10 22:56:29 -07:00

modperl

Make modperl support AddServerDependentCapability

2024-01-14 12:11:00 +00:00

modpython

Make modpython work with server-dependent caps

2024-01-14 11:12:32 +00:00

modtcl

Welcome to 2024

2023-12-31 21:09:25 +01:00

po

Update translations from Crowdin for id_ID

2024-02-26 00:33:25 +00:00

admindebug.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

adminlog.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

alias.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

autoattach.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

autocycle.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

autoop.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

autoreply.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

autovoice.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

awaynick.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

awaystore.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

block_motd.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

blockuser.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

bouncedcc.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

buffextras.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

cert.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

certauth.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

chansaver.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

clearbufferonmsg.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

clientnotify.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

CMakeLists.txt

Welcome to 2024

2023-12-31 21:09:25 +01:00

controlpanel.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

corecaps.cpp

Remove unused field and getter

2024-02-10 00:18:11 +00:00

crypt.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

ctcpflood.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

cyrusauth.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

dcc.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

disconkick.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

fail2ban.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

flooddetach.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

identfile.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

imapauth.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

keepnick.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

kickrejoin.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

lastseen.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

listsockets.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

log.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

missingmotd.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

modperl.cpp

Make modperl support AddServerDependentCapability

2024-01-14 12:11:00 +00:00

modpython.cpp

Make modpython work with server-dependent caps

2024-01-14 11:12:32 +00:00

modtcl.cpp

Fix RCE vulnerability in modtcl

2024-07-01 10:27:49 +01:00

modules_online.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

nickserv.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

notes.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

notify_connect.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

perform.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

perleval.pm

Welcome to 2024

2023-12-31 21:09:25 +01:00

pyeval.py

Welcome to 2024

2023-12-31 21:09:25 +01:00

raw.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

route_replies.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

sample.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

samplewebapi.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

sasl.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

savebuff.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

schat.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

send_raw.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

shell.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

simple_away.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

stickychan.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

stripcontrols.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

watch.cpp

Welcome to 2024

2023-12-31 21:09:25 +01:00

webadmin.cpp

Fix casing

2024-04-10 22:38:23 -07:00