On this page (7 sections)
On 3 November 2026 Canonical published Ubuntu Security Notice USN-8984-1 for jabberd2, a Jabber (XMPP) instant messenger server. The notice says jabberd2 accepted SASL ANONYMOUS authentication even when the configuration had not enabled it, which a remote attacker could possibly use to bypass authentication.
If you run a self-hosted chat server on Ubuntu 16.04 LTS, this is worth a few minutes today. The fix is a package update followed by a service restart.
What happened
According to the Ubuntu notice, jabberd2 allowed SASL ANONYMOUS authentication even when it was not enabled in the configuration. Ubuntu describes the impact as unintended access to network services, and says a remote attacker could possibly use the issue to bypass authentication. The notice references CVE-2017-10807.
The research for this story comes from the Ubuntu notice alone. It does not include a CVSS score, a CVE record or details about real-world exploitation, so none are claimed here. Treat the severity as unrated until you check the CVE record yourself.
Why this kind of flaw matters
SASL is the framework many chat and mail servers use to negotiate how a user proves who they are. ANONYMOUS is a mechanism that lets a client connect without credentials. It is harmless when you intend it, for example on a public chat service, but risky when an administrator has turned it off and the server accepts it anyway.
That is the weakness class here: a setting that looks enforced but is not. Anyone relying on the configuration to keep unauthenticated users out would have a false sense of protection. What an anonymous session could actually reach depends on your deployment, and the notice does not detail that, so assume the worst for any server exposed to the internet.
Who is affected
- Servers running the jabberd2 package on Ubuntu 16.04 LTS (xenial). That is the only release listed in the notice.
- Systems that have not yet received jabberd2 2.3.4-1ubuntu2+esm1 or later.
- Most exposed: servers whose XMPP ports are reachable from the internet, since the notice describes a remote attacker.
The fixed package carries an esm suffix, which points to Ubuntu's Extended Security Maintenance for 16.04. Ubuntu notes that Ubuntu Pro provides this coverage and is free for up to five machines. If the update does not appear on your system, check whether the machine is attached to Ubuntu Pro.
How to check your exposure
This read-only command lists the installed jabberd2 package and its version on Debian and Ubuntu systems. If the version is older than 2.3.4-1ubuntu2+esm1, you still need the fix.
dpkg -l jabberd2This command shows the installed and candidate versions from your configured repositories, which tells you whether the fixed build is available to your machine.
apt-cache policy jabberd2What to do now
Ubuntu's instructions are to perform a standard system update and then restart jabberd2 so the changes take effect.
This updates only the jabberd2 package to the latest available version on Ubuntu 16.04.
sudo apt-get update && sudo apt-get install --only-upgrade jabberd2After the update, restart the service. The notice does not name the service unit, so confirm how jabberd2 is managed on your host. On a default install the init script is commonly named jabberd2, but verify that before running this.
sudo systemctl restart jabberd20 of 7 done
Detection and monitoring
The notice does not describe indicators of compromise, so there is no confirmed signature to search for. Sensible steps are to review jabberd2 logs for sessions from unfamiliar addresses or accounts you do not recognize, and to note any activity from before you patched.
For a wider view of what your servers expose, a Webforta Scan can check verified sites read-only, and monitoring can alert you to uptime, certificate and DNS changes on the hosts around your chat service. Neither replaces patching the package itself.
Context and related updates
USN-8984-1 is one of several Ubuntu notices published in this period for older software. If you maintain legacy hosts, see our write-ups of USN-8986-1 for Swift Mailer and USN-8993-1 for SOGo, and our small business website security guide for general hardening.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.