OPENSUSE-SU-2021:0751-1 Security update for prosody

This update for prosody fixes the following issues: prosody was updated to 0.11.9: Security: modlimits, prosody.cfg.lua: Enable rate limits by default certmanager: Disable renegotiation by default modproxy65: Restrict access to local c2s connections by default util.startup: Set more aggressive...

openSUSE Security Update : prosody (openSUSE-2021-728)

This update for prosody fixes the following issues : prosody was updated to 0.11.9 : Security : - modlimits, prosody.cfg.lua: Enable rate limits by default - certmanager: Disable renegotiation by default - modproxy65: Restrict access to local c2s connections by default - util.startup: Set more...

Debian DSA-4916-1 : prosody - security update

Multiple security issues were found in Prosody, a lightweight Jabber/XMPP server, which could result in denial of service or information disclosure. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security...

Security update for prosody (important)

openSUSE Security Update: Security update for prosody Announcement ID: openSUSE-SU-2021:0751-1 Rating: important References: 1186027 Cross-References: CVE-2021-32917 CVE-2021-32918 CVE-2021-32919 CVE-2021-32920 Affected Products: openSUSE Backports SLE-15-SP2 An update that fixes four...

[SECURITY] [DSA 4916-1] prosody security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4916-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 17, 2021 https://www.debian.org/security/faq -...

DSA-4916-1 prosody - security update

Bulletin has no description...

openSUSE: Security Advisory for prosody (openSUSE-SU-2021:0728-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Denial Of Service (DoS)

Prosody is vulnerable to denial of service. An attacker is able to flood SSL/TLS renegotiation requests and potentially cause a denial of service condition...

Information Disclosure

prosody is vulnerable to information disclosure. The vulnerability exists as it does not use a constant-time algorithm for comparing secret strings when running under Lua 5.2 or later, allowing timing attacks to reveal the contents of secret strings...

Privilege Escalation

prosody is vulnerable to privilege escalation. The vulnerability exists due to an open access by default, even if neither of the users has an XMPP account on the local server, allowing unrestricted use of the server's bandwidth...

Authentication Bypass

prosody is vulnerable to authentication bypass. The undocumented dialbackwithoutdialback option in moddialback enables an experimental feature for server-to-server authentication. It does not correctly authenticate remote server certificates, allowing a remote server to impersonate another server...

Denial Of Service (DoS)

prosody is vulnerable to denial of service. A remote unauthenticated attacker is able to crash the application via memory exhaustion when running under Lua 5.2 or Lua 5.3 on default settings...

OPENSUSE-SU-2021:0728-1 Security update for prosody

This update for prosody fixes the following issues: prosody was updated to 0.11.9: Security: modlimits, prosody.cfg.lua: Enable rate limits by default certmanager: Disable renegotiation by default modproxy65: Restrict access to local c2s connections by default util.startup: Set more aggressive...

FreeBSD : Prosody -- multiple vulnerabilities (fc75570a-b417-11eb-a23d-c7ab331fd711)

The Prosody security advisory 2021-05-12 reports : This advisory details 5 new security vulnerabilities discovered in the Prosody.im XMPP server software. All issues are fixed in the 0.11.9 release default configuration. - CVE-2021-32918: DoS via insufficient memory consumption controls -...

CVE-2021-32917

An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither of the users has an XMPP account on the local server, allowing unrestricted use of the server's bandwidth...

CVE-2021-32920

Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests...

CVE-2021-32921

An issue was discovered in Prosody before 0.11.9. It does not use a constant-time algorithm for comparing certain secret strings when running under Lua 5.2 or later. This can potentially be used in a timing attack to reveal the contents of secret strings to an attacker...

CVE-2021-32918

An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service DoS attacks via memory exhaustion when running under Lua 5.2 or Lua 5.3...

CVE-2021-32918

An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service DoS attacks via memory exhaustion when running under Lua 5.2 or Lua 5.3...

CVE-2021-32919

An issue was discovered in Prosody before 0.11.9. The undocumented dialbackwithoutdialback option in moddialback enables an experimental feature for server-to-server authentication. It does not correctly authenticate remote server certificates, allowing a remote server to impersonate another serv...