CVE-2021-21431

Advisory

Sopel-plugins-channelmgnt includes a fix for CVE-2021-21431: In versions prior to 2.0.1, on some IRC servers, restrictions around the removal of the bot using the kick/kickban command could be bypassed when kicking multiple users at once. It is also believed that it may have been possible to remove users from other channels. Freenode is not affected. As a workaround, do not use this plugin on networks where TARGMAX > 1.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21431
• https://github.com/MirahezeBots/sopel-channelmgnt/security/advisories/GHSA-23c7-6444-399m
• https://pypi.org/project/sopel-plugins.channelmgnt/
• https://github.com/MirahezeBots/sopel-channelmgnt/commit/7c96d400358221e59135f0a0be0744f3fad73856