What’s Vulnerable › Vulnerabilities

CVE-2017-8342

• Severity: high (CVSS 8.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-04-30 · updated 2026-06-17
• Weakness: CWE-362

Description

Radicale before 1.1.2 and 2.x before 2.0.0rc2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method.

Affected products

• Radicale: through 1.1.1; 2.0.0-rc1

References

• https://bugs.debian.org/861514
• https://github.com/Kozea/Radicale/blob/1.1.2/NEWS.rst
• https://github.com/Kozea/Radicale/commit/059ba8dec1f22ccbeab837e288b3833a099cee2d
• https://github.com/Kozea/Radicale/commit/190b1dd795f0c552a4992445a231da760211183b
• https://lists.debian.org/debian-lts-announce/2020/04/msg00019.html
• https://bugs.debian.org/861514
• https://github.com/Kozea/Radicale/blob/1.1.2/NEWS.rst
• https://github.com/Kozea/Radicale/commit/059ba8dec1f22ccbeab837e288b3833a099cee2d
• https://github.com/Kozea/Radicale/commit/190b1dd795f0c552a4992445a231da760211183b
• https://lists.debian.org/debian-lts-announce/2020/04/msg00019.html

Get alerted when CVE-2017-8342 or the next vulnerability affects your stack