rpm package
suse/prosody&distro=SUSE Package Hub 15 SP2
pkg:rpm/suse/prosody&distro=SUSE%20Package%20Hub%2015%20SP2
Vulnerabilities (4)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-32920 | Hig | 7.5 | < 0.11.9-bp152.2.3.1 | 0.11.9-bp152.2.3.1 | May 13, 2021 | Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests. | |
| CVE-2021-32919 | Hig | 7.5 | < 0.11.9-bp152.2.3.1 | 0.11.9-bp152.2.3.1 | May 13, 2021 | An issue was discovered in Prosody before 0.11.9. The undocumented dialback_without_dialback option in mod_dialback enables an experimental feature for server-to-server authentication. It does not correctly authenticate remote server certificates, allowing a remote server to impe | |
| CVE-2021-32918 | Hig | 7.5 | < 0.11.9-bp152.2.3.1 | 0.11.9-bp152.2.3.1 | May 13, 2021 | An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service (DoS) attacks via memory exhaustion when running under Lua 5.2 or Lua 5.3. | |
| CVE-2021-32917 | Med | 5.3 | < 0.11.9-bp152.2.3.1 | 0.11.9-bp152.2.3.1 | May 13, 2021 | An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither of the users has an XMPP account on the local server, allowing unrestricted use of the server's bandwidth. |
- affected < 0.11.9-bp152.2.3.1fixed 0.11.9-bp152.2.3.1
Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests.
- affected < 0.11.9-bp152.2.3.1fixed 0.11.9-bp152.2.3.1
An issue was discovered in Prosody before 0.11.9. The undocumented dialback_without_dialback option in mod_dialback enables an experimental feature for server-to-server authentication. It does not correctly authenticate remote server certificates, allowing a remote server to impe
- affected < 0.11.9-bp152.2.3.1fixed 0.11.9-bp152.2.3.1
An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service (DoS) attacks via memory exhaustion when running under Lua 5.2 or Lua 5.3.
- affected < 0.11.9-bp152.2.3.1fixed 0.11.9-bp152.2.3.1
An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither of the users has an XMPP account on the local server, allowing unrestricted use of the server's bandwidth.