BLOG
At a glance
- Ubuntu USN-9084-1 fixes CVE-2017-8342 in Radicale.
- Ubuntu xenial systems using htpasswd authentication face a remote password-guessing risk.
- Update the Radicale packages to the fixed version and restart the service.
Ubuntu xenial: update Radicale to address password exposure risk
Ubuntu USN-9084-1 fixes CVE-2017-8342 in Radicale on Ubuntu xenial. With htpasswd authentication, responses without delays may aid remote password guessing. Update the Radicale packages to the fixed version and restart the service.
In this article
Ubuntu has issued USN-9084-1 to address CVE-2017-8342 in Radicale on Ubuntu xenial. The notice says the issue concerns htpasswd authentication and could allow user passwords to be obtained over the network. Read the Ubuntu security notice.
Overview and technical details
Radicale is a CalDAV/CardDAV calendar and contacts server. When htpasswd authentication is used, Radicale does not delay failed authentication attempts; a remote attacker may exploit response-time differences or brute-force to obtain user passwords.
| Field | Details |
|---|---|
| Product | Radicale |
| CVE | CVE-2017-8342 |
| Source | Ubuntu USN-9084-1 |
Affected systems
The notice identifies Ubuntu xenial and the following Radicale packages. The fixed versions are provided in the esm-apps-legacy pocket.
| Product | Fixed version |
|---|---|
| python-radicale | 1.1.1-1ubuntu0.1~esm1 |
| python3-radicale | 1.1.1-1ubuntu0.1~esm1 |
| radicale | 1.1.1-1ubuntu0.1~esm1 |
Mechanism and impact
Because failed authentication attempts are not delayed, a remote attacker may use response timing or brute-force to obtain user passwords. The stated impact is a risk of password exposure.
System checks
Check the versions of installed Radicale packages on Ubuntu xenial. Version 1.1.1-1ubuntu0.1~esm1 or later meets the fixed-version threshold; earlier versions need updating. If the radicale package is not installed, check the corresponding python-radicale and python3-radicale packages.
dpkg-query -W -f='${Package} ${Version}\n' python-radicale python3-radicale radicale dpkg --compare-versions "$(dpkg-query -W -f='${Version}' radicale 2>/dev/null)" ge 1.1.1-1ubuntu0.1~esm1Check Ubuntu Pro status to determine whether packages can be received from the esm-apps-legacy pocket; review the ESM Apps service status.
pro status
Remediation and mitigation
Install the standard system update that provides the fixed Radicale packages, version 1.1.1-1ubuntu0.1~esm1.
After updating, restart Radicale to fully apply the changes.
Related articles
Ubuntu Linux kernel for NVIDIA Tegra: check systems and apply security updates
Ubuntu USN-9091-1 warns of multiple vulnerabilities in the Linux kernel for NVIDIA Tegra. The supplied record gives no affected branches or fixed packages. Check installed kernels and packages, then consult the Ubuntu notice for the applicable update.
Linux Kernel: n_gsm race condition may enable local privilege escalation
Zero Day Initiative published an advisory for CVE-2024-50073, a race condition in the Linux Kernel n_gsm driver. An attacker needs local access to execute highly privileged code; successful exploitation may enable privilege escalation and code execution in the kernel context. Identify the kernel…
Linux Kernel: SCTP race condition allows privilege escalation
Zero Day Initiative disclosed CVE-2026-98130, a race condition in the Linux Kernel SCTP subsystem. A local low-privileged user may escalate privileges and execute code in kernel context. Prioritize installing the Linux fix; the record does not specify affected or fixed versions.
Linux Kernel: CVE-2026-98797 allows local users to escalate privileges
Zero Day Initiative reports CVE-2026-98797 in Linux Kernel Net Scheduler Qdisc. Improper input validation can cause an out-of-bounds write, potentially enabling privilege escalation and code execution in the kernel context. Check the running kernel and prioritize the Linux fix.