opensuse-su-2021:0751-1
Vulnerability from csaf_opensuse
Published
2021-05-18 04:04
Modified
2021-05-18 04:04
Summary
Security update for prosody

Notes

Title of the patch
Security update for prosody
Description of the patch
This update for prosody fixes the following issues: prosody was updated to 0.11.9: Security: * mod_limits, prosody.cfg.lua: Enable rate limits by default * certmanager: Disable renegotiation by default * mod_proxy65: Restrict access to local c2s connections by default * util.startup: Set more aggressive defaults for GC * mod_c2s, mod_s2s, mod_component, mod_bosh, mod_websockets: Set default stanza size limits * mod_authinternal{plain,hashed}: Use constant-time string comparison for secrets * mod_dialback: Remove dialback-without-dialback feature * mod_dialback: Use constant-time comparison with hmac Minor changes: * util.hashes: Add constant-time string comparison (binding to CRYPTO_memcmp) * mod_c2s: Don’t throw errors in async code when connections are gone * mod_c2s: Fix traceback in session close when conn is nil * core.certmanager: Improve detection of LuaSec/OpenSSL capabilities * mod_saslauth: Use a defined SASL error * MUC: Add support for advertising muc#roomconfig_allowinvites in room disco#info * mod_saslauth: Don’t throw errors in async code when connections are gone * mod_pep: Advertise base pubsub feature (fixes #1632: mod_pep missing pubsub feature in disco) * prosodyctl check config: Add ‘gc’ to list of global options * prosodyctl about: Report libexpat version if known * util.xmppstream: Add API to dynamically configure the stanza size limit for a stream * util.set: Add is_set() to test if an object is a set * mod_http: Skip IP resolution in non-proxied case * mod_c2s: Log about missing conn on async state changes * util.xmppstream: Reduce internal default xmppstream limit to 1MB Relevant: https://prosody.im/security/advisory_20210512 * boo#1186027: Prosody XMPP server advisory 2021-05-12 * CVE-2021-32919 * CVE-2021-32917 * CVE-2021-32917 * CVE-2021-32920 * CVE-2021-32918 Update to 0.11.8: Security: * mod_saslauth: Disable ‘tls-unique’ channel binding with TLS 1.3 (#1542) Fixes and improvements: * net.websocket.frames: Improve websocket masking performance by using the new util.strbitop * util.strbitop: Library for efficient bitwise operations on strings Minor changes: * MUC: Correctly advertise whether the subject can be changed (#1155) * MUC: Preserve disco ‘node’ attribute (or lack thereof) in responses (#1595) * MUC: Fix logic bug causing unnecessary presence to be sent (#1615) * mod_bosh: Fix error if client tries to connect to component (#425) * mod_bosh: Pick out the ‘wait’ before checking it instead of earlier * mod_pep: Advertise base PubSub feature (#1632) * mod_pubsub: Fix notification stanza type setting (#1605) * mod_s2s: Prevent keepalives before client has established a stream * net.adns: Fix bug that sent empty DNS packets (#1619) * net.http.server: Don’t send Content-Length on 1xx/204 responses (#1596) * net.websocket.frames: Fix length calculation bug (#1598) * util.dbuffer: Make length API in line with Lua strings * util.dbuffer: Optimize substring operations * util.debug: Fix locals being reported under wrong stack frame in some cases * util.dependencies: Fix check for Lua bitwise operations library (#1594) * util.interpolation: Fix combination of filters and fallback values #1623 * util.promise: Preserve tracebacks * util.stanza: Reject ASCII control characters (#1606) * timers: Ensure timers can’t block other processing (#1620) Update to 0.11.7: Security: * mod_websocket: Enforce size limits on received frames (fixes #1593) Fixes and improvements: * mod_c2s, mod_s2s: Make stanza size limits configurable * Add configuration options to control Lua garbage collection parameters * net.http: Backport SNI support for outgoing HTTP requests (#409) * mod_websocket: Process all data in the buffer on close frame and connection errors (fixes #1474, #1234) * util.indexedbheap: Fix heap data structure corruption, causing some timers to fail after a reschedule (fixes #1572) Update to 0.11.6: Fixes and improvements: * mod_storage_internal: Fix error in time limited queries on items without ‘when’ field, fixes #1557 * mod_carbons: Fix handling of incoming MUC PMs #1540 * mod_csi_simple: Consider XEP-0353: Jingle Message Initiation important * mod_http_files: Avoid using inode in etag, fixes #1498: Fail to download file on FreeBSD * mod_admin_telnet: Create a DNS resolver per console session (fixes #1492: Telnet console DNS commands reduced usefulness) * core.certmanager: Move EECDH ciphers before EDH in default cipherstring (fixes #1513) * mod_s2s: Escape invalid XML in loggin (same way as mod_c2s) (fixes #1574: Invalid XML input on s2s connection is logged unescaped) * mod_muc: Allow control over the server-admins-are-room-owners feature (see #1174) * mod_muc_mam: Remove spoofed archive IDs before archiving (fixes #1552: MUC MAM may strip its own archive id) * mod_muc_mam: Fix stanza id filter event name, fixes #1546: mod_muc_mam does not strip spoofed stanza ids * mod_muc_mam: Fix missing advertising of XEP-0359, fixes #1547: mod_muc_mam does not advertise stanza-id Minor changes: * net.http API: Add request:cancel() method * net.http API: Fix traceback on invalid URL passed to request() * MUC: Persist affiliation_data in new MUC format * mod_websocket: Fire event on session creation (thanks Aaron van Meerten) * MUC: Always include ‘affiliation’/‘role’ attributes, defaulting to ‘none’ if nil * mod_tls: Log when certificates are (re)loaded * mod_vcard4: Report correct error condition (fixes #1521: mod_vcard4 reports wrong error) * net.http: Re-expose destroy_request() function (fixes unintentional API breakage) * net.http.server: Strip port from Host header in IPv6 friendly way (fix #1302) * util.prosodyctl: Tell prosody do daemonize via command line flag (fixes #1514) * SASL: Apply saslprep where necessary, fixes #1560: Login fails if password contains special chars * net.http.server: Fix reporting of missing Host header * util.datamanager API: Fix iterating over “users” (thanks marc0s) * net.resolvers.basic: Default conn_type to ‘tcp’ consistently if unspecified (thanks marc0s) * mod_storage_sql: Fix check for deletion limits (fixes #1494) * mod_admin_telnet: Handle unavailable cipher info (fixes #1510: mod_admin_telnet backtrace) * Log warning when using prosodyctl start/stop/restart * core.certmanager: Look for privkey.pem to go with fullchain.pem (fixes #1526) * mod_storage_sql: Add index covering sort_id to improve performance (fixes #1505) * mod_mam,mod_muc_mam: Allow other work to be performed during archive cleanup (fixes #1504) * mod_muc_mam: Don’t strip MUC tags, fix #1567: MUC tags stripped by mod_muc_mam * mod_pubsub, mod_pep: Ensure correct number of children of (fixes #1496) * mod_register_ibr: Add FORM_TYPE as required by XEP-0077 (fixes #1511) * mod_muc_mam: Fix traceback saving message from non-occupant (fixes #1497) * util.startup: Remove duplicated initialization of logging (fix #1527: startup: Logging initialized twice) This update was imported from the openSUSE:Leap:15.2:Update update project.
Patchnames
openSUSE-2021-751
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for prosody",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for prosody fixes the following issues:\n\nprosody was updated to 0.11.9:\n\nSecurity:\n\n* mod_limits, prosody.cfg.lua: Enable rate limits by default\n* certmanager: Disable renegotiation by default\n* mod_proxy65: Restrict access to local c2s connections by default\n* util.startup: Set more aggressive defaults for GC\n* mod_c2s, mod_s2s, mod_component, mod_bosh, mod_websockets: Set default stanza size limits\n* mod_authinternal{plain,hashed}: Use constant-time string comparison for secrets\n* mod_dialback: Remove dialback-without-dialback feature\n* mod_dialback: Use constant-time comparison with hmac\n\nMinor changes:\n\n* util.hashes: Add constant-time string comparison (binding to CRYPTO_memcmp)\n* mod_c2s: Don\u2019t throw errors in async code when connections are gone\n* mod_c2s: Fix traceback in session close when conn is nil\n* core.certmanager: Improve detection of LuaSec/OpenSSL capabilities\n* mod_saslauth: Use a defined SASL error\n* MUC: Add support for advertising muc#roomconfig_allowinvites in room disco#info\n* mod_saslauth: Don\u2019t throw errors in async code when connections are gone\n* mod_pep: Advertise base pubsub feature (fixes #1632: mod_pep missing pubsub feature in disco)\n* prosodyctl check config: Add \u2018gc\u2019 to list of global options\n* prosodyctl about: Report libexpat version if known\n* util.xmppstream: Add API to dynamically configure the stanza size limit for a stream\n* util.set: Add is_set() to test if an object is a set\n* mod_http: Skip IP resolution in non-proxied case\n* mod_c2s: Log about missing conn on async state changes\n* util.xmppstream: Reduce internal default xmppstream limit to 1MB\n\nRelevant: https://prosody.im/security/advisory_20210512\n\n* boo#1186027: Prosody XMPP server advisory 2021-05-12\n* CVE-2021-32919\n* CVE-2021-32917\n* CVE-2021-32917\n* CVE-2021-32920\n* CVE-2021-32918\n\nUpdate to 0.11.8:\n\nSecurity:\n* mod_saslauth: Disable \u2018tls-unique\u2019 channel binding with TLS 1.3 (#1542)\n\nFixes and improvements:\n\n* net.websocket.frames: Improve websocket masking performance by using the new util.strbitop\n* util.strbitop: Library for efficient bitwise operations on strings\n\nMinor changes:\n\n* MUC: Correctly advertise whether the subject can be changed (#1155)\n* MUC: Preserve disco \u2018node\u2019 attribute (or lack thereof) in responses (#1595)\n* MUC: Fix logic bug causing unnecessary presence to be sent (#1615)\n* mod_bosh: Fix error if client tries to connect to component (#425)\n* mod_bosh: Pick out the \u2018wait\u2019 before checking it instead of earlier\n* mod_pep: Advertise base PubSub feature (#1632)\n* mod_pubsub: Fix notification stanza type setting (#1605)\n* mod_s2s: Prevent keepalives before client has established a stream\n* net.adns: Fix bug that sent empty DNS packets (#1619)\n* net.http.server: Don\u2019t send Content-Length on 1xx/204 responses (#1596)\n* net.websocket.frames: Fix length calculation bug (#1598)\n* util.dbuffer: Make length API in line with Lua strings\n* util.dbuffer: Optimize substring operations\n* util.debug: Fix locals being reported under wrong stack frame in some cases\n* util.dependencies: Fix check for Lua bitwise operations library (#1594)\n* util.interpolation: Fix combination of filters and fallback values #1623\n* util.promise: Preserve tracebacks\n* util.stanza: Reject ASCII control characters (#1606)\n* timers: Ensure timers can\u2019t block other processing (#1620)\n\nUpdate to 0.11.7:\n\nSecurity:\n\n* mod_websocket: Enforce size limits on received frames (fixes #1593)\n\nFixes and improvements:\n\n* mod_c2s, mod_s2s: Make stanza size limits configurable\n* Add configuration options to control Lua garbage collection parameters\n* net.http: Backport SNI support for outgoing HTTP requests (#409)\n* mod_websocket: Process all data in the buffer on close frame and connection errors (fixes #1474, #1234)\n* util.indexedbheap: Fix heap data structure corruption, causing some timers to fail after a reschedule (fixes #1572)\n\nUpdate to 0.11.6:\n\nFixes and improvements:\n\n* mod_storage_internal: Fix error in time limited queries on items without \u2018when\u2019 field, fixes #1557\n* mod_carbons: Fix handling of incoming MUC PMs #1540\n* mod_csi_simple: Consider XEP-0353: Jingle Message Initiation important\n* mod_http_files: Avoid using inode in etag, fixes #1498: Fail to download file on FreeBSD\n* mod_admin_telnet: Create a DNS resolver per console session (fixes #1492: Telnet console DNS commands reduced usefulness)\n* core.certmanager: Move EECDH ciphers before EDH in default cipherstring (fixes #1513)\n* mod_s2s: Escape invalid XML in loggin (same way as mod_c2s) (fixes #1574: Invalid XML input on s2s connection is logged unescaped)\n* mod_muc: Allow control over the server-admins-are-room-owners feature (see #1174)\n* mod_muc_mam: Remove spoofed archive IDs before archiving (fixes #1552: MUC MAM may strip its own archive id)\n* mod_muc_mam: Fix stanza id filter event name, fixes #1546: mod_muc_mam does not strip spoofed stanza ids\n* mod_muc_mam: Fix missing advertising of XEP-0359, fixes #1547: mod_muc_mam does not advertise stanza-id\n\nMinor changes:\n\n* net.http API: Add request:cancel() method\n* net.http API: Fix traceback on invalid URL passed to request()\n* MUC: Persist affiliation_data in new MUC format\n* mod_websocket: Fire event on session creation (thanks Aaron van Meerten)\n* MUC: Always include \u2018affiliation\u2019/\u2018role\u2019 attributes, defaulting to \u2018none\u2019 if nil\n* mod_tls: Log when certificates are (re)loaded\n* mod_vcard4: Report correct error condition (fixes #1521: mod_vcard4 reports wrong error)\n* net.http: Re-expose destroy_request() function (fixes unintentional API breakage)\n* net.http.server: Strip port from Host header in IPv6 friendly way (fix #1302)\n* util.prosodyctl: Tell prosody do daemonize via command line flag (fixes #1514)\n* SASL: Apply saslprep where necessary, fixes #1560: Login fails if password contains special chars\n* net.http.server: Fix reporting of missing Host header\n* util.datamanager API: Fix iterating over \u201cusers\u201d (thanks marc0s)\n* net.resolvers.basic: Default conn_type to \u2018tcp\u2019 consistently if unspecified (thanks marc0s)\n* mod_storage_sql: Fix check for deletion limits (fixes #1494)\n* mod_admin_telnet: Handle unavailable cipher info (fixes #1510: mod_admin_telnet backtrace)\n* Log warning when using prosodyctl start/stop/restart\n* core.certmanager: Look for privkey.pem to go with fullchain.pem (fixes #1526)\n* mod_storage_sql: Add index covering sort_id to improve performance (fixes #1505)\n* mod_mam,mod_muc_mam: Allow other work to be performed during archive cleanup (fixes #1504)\n* mod_muc_mam: Don\u2019t strip MUC tags, fix #1567: MUC tags stripped by mod_muc_mam\n* mod_pubsub, mod_pep: Ensure correct number of children of (fixes #1496)\n* mod_register_ibr: Add FORM_TYPE as required by XEP-0077 (fixes #1511)\n* mod_muc_mam: Fix traceback saving message from non-occupant (fixes #1497)\n* util.startup: Remove duplicated initialization of logging (fix #1527: startup: Logging initialized twice)\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2021-751",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_0751-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2021:0751-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FJYSI5GATCA32NI325BJB4SQGVY6RLE7/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2021:0751-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FJYSI5GATCA32NI325BJB4SQGVY6RLE7/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1186027",
        "url": "https://bugzilla.suse.com/1186027"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-32917 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-32917/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-32918 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-32918/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-32919 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-32919/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-32920 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-32920/"
      }
    ],
    "title": "Security update for prosody",
    "tracking": {
      "current_release_date": "2021-05-18T04:04:55Z",
      "generator": {
        "date": "2021-05-18T04:04:55Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2021:0751-1",
      "initial_release_date": "2021-05-18T04:04:55Z",
      "revision_history": [
        {
          "date": "2021-05-18T04:04:55Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "prosody-0.11.9-bp152.2.3.1.aarch64",
                "product": {
                  "name": "prosody-0.11.9-bp152.2.3.1.aarch64",
                  "product_id": "prosody-0.11.9-bp152.2.3.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "prosody-0.11.9-bp152.2.3.1.ppc64le",
                "product": {
                  "name": "prosody-0.11.9-bp152.2.3.1.ppc64le",
                  "product_id": "prosody-0.11.9-bp152.2.3.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "prosody-0.11.9-bp152.2.3.1.s390x",
                "product": {
                  "name": "prosody-0.11.9-bp152.2.3.1.s390x",
                  "product_id": "prosody-0.11.9-bp152.2.3.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "prosody-0.11.9-bp152.2.3.1.x86_64",
                "product": {
                  "name": "prosody-0.11.9-bp152.2.3.1.x86_64",
                  "product_id": "prosody-0.11.9-bp152.2.3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Package Hub 15 SP2",
                "product": {
                  "name": "SUSE Package Hub 15 SP2",
                  "product_id": "SUSE Package Hub 15 SP2"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "prosody-0.11.9-bp152.2.3.1.aarch64 as component of SUSE Package Hub 15 SP2",
          "product_id": "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.aarch64"
        },
        "product_reference": "prosody-0.11.9-bp152.2.3.1.aarch64",
        "relates_to_product_reference": "SUSE Package Hub 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "prosody-0.11.9-bp152.2.3.1.ppc64le as component of SUSE Package Hub 15 SP2",
          "product_id": "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.ppc64le"
        },
        "product_reference": "prosody-0.11.9-bp152.2.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Package Hub 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "prosody-0.11.9-bp152.2.3.1.s390x as component of SUSE Package Hub 15 SP2",
          "product_id": "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.s390x"
        },
        "product_reference": "prosody-0.11.9-bp152.2.3.1.s390x",
        "relates_to_product_reference": "SUSE Package Hub 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "prosody-0.11.9-bp152.2.3.1.x86_64 as component of SUSE Package Hub 15 SP2",
          "product_id": "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.x86_64"
        },
        "product_reference": "prosody-0.11.9-bp152.2.3.1.x86_64",
        "relates_to_product_reference": "SUSE Package Hub 15 SP2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-32917",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-32917"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither of the users has an XMPP account on the local server, allowing unrestricted use of the server\u0027s bandwidth.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.aarch64",
          "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.ppc64le",
          "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.s390x",
          "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-32917",
          "url": "https://www.suse.com/security/cve/CVE-2021-32917"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1186027 for CVE-2021-32917",
          "url": "https://bugzilla.suse.com/1186027"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.aarch64",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.ppc64le",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.s390x",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.aarch64",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.ppc64le",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.s390x",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-05-18T04:04:55Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-32917"
    },
    {
      "cve": "CVE-2021-32918",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-32918"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service (DoS) attacks via memory exhaustion when running under Lua 5.2 or Lua 5.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.aarch64",
          "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.ppc64le",
          "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.s390x",
          "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-32918",
          "url": "https://www.suse.com/security/cve/CVE-2021-32918"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1186027 for CVE-2021-32918",
          "url": "https://bugzilla.suse.com/1186027"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.aarch64",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.ppc64le",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.s390x",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.aarch64",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.ppc64le",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.s390x",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-05-18T04:04:55Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-32918"
    },
    {
      "cve": "CVE-2021-32919",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-32919"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Prosody before 0.11.9. The undocumented dialback_without_dialback option in mod_dialback enables an experimental feature for server-to-server authentication. It does not correctly authenticate remote server certificates, allowing a remote server to impersonate another server (when this option is enabled).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.aarch64",
          "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.ppc64le",
          "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.s390x",
          "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-32919",
          "url": "https://www.suse.com/security/cve/CVE-2021-32919"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1186027 for CVE-2021-32919",
          "url": "https://bugzilla.suse.com/1186027"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.aarch64",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.ppc64le",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.s390x",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.aarch64",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.ppc64le",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.s390x",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-05-18T04:04:55Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-32919"
    },
    {
      "cve": "CVE-2021-32920",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-32920"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.aarch64",
          "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.ppc64le",
          "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.s390x",
          "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-32920",
          "url": "https://www.suse.com/security/cve/CVE-2021-32920"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1186027 for CVE-2021-32920",
          "url": "https://bugzilla.suse.com/1186027"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.aarch64",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.ppc64le",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.s390x",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.aarch64",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.ppc64le",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.s390x",
            "SUSE Package Hub 15 SP2:prosody-0.11.9-bp152.2.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-05-18T04:04:55Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-32920"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.