CVE-2023-2160

Advisory

Modoboa 2.1.0 includes a fix for a weak password requirement vulnerability.
https://github.com/modoboa/modoboa/pull/2949/commits/130257c96a2392ada795785a91178e656e27015c

Affected package

Affected versions

Fixed versions

Vulnerability changelog

What's Changed
* added core language migration by Spitfireap in https://github.com/modoboa/modoboa/pull/2882
* Moved DMARC plugin back to core repo by tonioo in https://github.com/modoboa/modoboa/pull/2793
* added pdfcredential support for v2 by Spitfireap in https://github.com/modoboa/modoboa/pull/2791
* Added missing permissions on API endpoints by tonioo in https://github.com/modoboa/modoboa/pull/2888
* Fixed CSRF issues in edit operations. by tonioo in https://github.com/modoboa/modoboa/pull/2889
* Make sure to reset creation forms between 2 uses. by tonioo in https://github.com/modoboa/modoboa/pull/2887
* Added ability to disable inactive accounts by Spitfireap in https://github.com/modoboa/modoboa/pull/2885
* Bump django-otp from 1.1.4 to 1.1.6 by dependabot in https://github.com/modoboa/modoboa/pull/2910
* Translate 'frontend/locale/en/LC_MESSAGES/app.po' in 'fr' by transifex-integration in https://github.com/modoboa/modoboa/pull/2926
* Bump webpack from 5.74.0 to 5.76.1 in /frontend by dependabot in https://github.com/modoboa/modoboa/pull/2929
* Bump sideway/formula from 3.0.0 to 3.0.1 in /frontend by dependabot in https://github.com/modoboa/modoboa/pull/2930
* Added an alarm on dkim write error, reworked alarms by Spitfireap in https://github.com/modoboa/modoboa/pull/2884
* Added translation info to doc by Spitfireap in https://github.com/modoboa/modoboa/pull/2883
* Fixed security issue with password update. by tonioo in https://github.com/modoboa/modoboa/pull/2949
* Import imap-migration by Spitfireap in https://github.com/modoboa/modoboa/pull/2911
* Make sure to respect error field max length. by tonioo in https://github.com/modoboa/modoboa/pull/2956
* Display account quota usage in new UI by tonioo in https://github.com/modoboa/modoboa/pull/2958


**Full Changelog**: https://github.com/modoboa/modoboa/compare/2.0.5...2.1.0

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2160
• https://huntr.dev/bounties/54fb6d6a-6b39-45b6-b62a-930260ba484b
• https://github.com/modoboa/modoboa/commit/130257c96a2392ada795785a91178e656e27015c