# Radicale authentication vulnerability patched in Ubuntu 16.04 LTS

> **Key takeaway:** A flaw in Radicale's htpasswd authentication allowed remote attackers to perform timing or brute-force attacks to recover passwords.

**Published:** 2026-11-12T20:54:41+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/radicale-authentication-vulnerability-patched-in-ubuntu-1604.html 

## Summary
Ubuntu has released security updates to address a vulnerability in Radicale, a lightweight calendar and address book server. The flaw specifically affects instances utilizing htpasswd for user authentication.

Remote attackers could exploit the lack of delays in failed authentication attempts to conduct timing attacks or brute-force password discovery. The fix is provided via Ubuntu Pro ESM (Extended Security Maintenance) for users on the 16.04 LTS release.

## Vulnerability details and mitigation
- **CVE Identifier:** The vulnerability is tracked as CVE-2017-8342.
- **Defect Class:** The issue involves a lack of authentication delay, enabling remote timing or brute-force attacks.
- **Affected Component:** The flaw resides in the authentication logic when using the htpasswd mechanism in Radicale.
- **Fixed Versions:** Patched packages for Ubuntu 16.04 include python-radicale, python3-radicale, and radicale at version 1.1.1-1ubuntu0.1~esm1.

## Why it matters
Users running legacy Ubuntu 16.04 systems must apply these updates via Ubuntu Pro to secure their calendar and contact synchronization services. System administrators should ensure the Radicale service is restarted following the package update to apply the security changes.