Prosody 0.11.6

CPE Details

Prosody 0.11.6
prosody
prosody
0.11.6
2022-09-22
10h58 +00:00
2022-09-22
11h00 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:prosody:prosody:0.11.6:*:*:*:*:*:*:*

Informations

Vendor

prosody

Product

prosody

Version

0.11.6

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2022-0217 2022-08-26 15h25 +00:00 It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).
7.5
High
CVE-2021-37601 2021-07-28 11h52 +00:00 muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations.
7.5
High
CVE-2021-32921 2021-05-13 13h14 +00:00 An issue was discovered in Prosody before 0.11.9. It does not use a constant-time algorithm for comparing certain secret strings when running under Lua 5.2 or later. This can potentially be used in a timing attack to reveal the contents of secret strings to an attacker.
5.9
Medium
CVE-2021-32920 2021-05-13 13h14 +00:00 Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests.
7.5
High
CVE-2021-32919 2021-05-13 13h12 +00:00 An issue was discovered in Prosody before 0.11.9. The undocumented dialback_without_dialback option in mod_dialback enables an experimental feature for server-to-server authentication. It does not correctly authenticate remote server certificates, allowing a remote server to impersonate another server (when this option is enabled).
7.5
High
CVE-2021-32918 2021-05-13 13h11 +00:00 An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service (DoS) attacks via memory exhaustion when running under Lua 5.2 or Lua 5.3.
7.5
High
CVE-2021-32917 2021-05-13 13h10 +00:00 An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither of the users has an XMPP account on the local server, allowing unrestricted use of the server's bandwidth.
5.3
Medium