Security Update for Prosody
Summary
DSA-3439-1: prosody - security update. Affects prosody versions < 0.8.2-4+deb7u3. Fixed in 0.8.2-4+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Prosody is a lightweight Jabber/XMPP server that enables instant messaging and real-time communication. It is designed to be efficient, extensible, and secure. However, two vulnerabilities have been discovered in Prosody that could compromise the security of the server.
Vulnerability Detail
The first vulnerability, identified as CVE-2016-1231, allows the HTTP file-serving module in Prosody to serve requests outside of the configured public root directory. This flaw could be exploited by a remote attacker to access private files, including sensitive data. It is important to note that the default configuration does not enable the vulnerable module.
The second vulnerability, known as CVE-2016-1232, involves the generation of the secret token for server-to-server dialback authentication. Prosody relies on a weak random number generator, making it possible for a remote attacker to guess the secret key and impersonate the affected domain to other servers on the network.
How To Fix
Minimum fixed version
0.8.2-4+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade prosodyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
It is crucial to upgrade your Prosody packages to the fixed versions mentioned above to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for prosody →
FAQ
Prosody is a lightweight Jabber/XMPP server used for instant messaging and real-time communication.
CVE-2016-1231 is a vulnerability in Prosody's HTTP file-serving module that allows serving requests outside of the configured public root directory, potentially granting access to private files.
CVE-2016-1232 is a vulnerability in Prosody's generation of the secret token for server-to-server dialback authentication. It relies on a weak random number generator, enabling a remote attacker to guess the secret key and impersonate the affected domain to other servers on the network.
To fix these vulnerabilities, it is recommended to upgrade your Prosody packages to the provided fixed versions.
No, the default configuration does not enable the mod_http_files module, which is vulnerable to CVE-2016-1231. However, it is still important to upgrade to the fixed versions to ensure overall security.
Related vulnerabilities
Recent vulnerabilities recorded for prosody.
