openSUSE Leap 15.2: 2021:0728-2 Critical Prosody Patch Details

This update for prosody fixes the following issues:

prosody was updated to 0.11.9:

Security:

* mod_limits, prosody.cfg.lua: Enable rate limits by default

* certmanager: Disable renegotiation by default

* mod_proxy65: Restrict access to local c2s connections by default

* util.startup: Set more aggressive defaults for GC

* mod_c2s, mod_s2s, mod_component, mod_bosh, mod_websockets: Set default

stanza size limits

* mod_authinternal{plain,hashed}: Use constant-time string comparison for

secrets

* mod_dialback: Remove dialback-without-dialback feature

* mod_dialback: Use constant-time comparison with hmac

Minor changes:

* util.hashes: Add constant-time string comparison (binding to

CRYPTO_memcmp)

* mod_c2s: Don???t throw errors in async code when connections are gone

* mod_c2s: Fix traceback in session close when conn is nil

* core.certmanager: Improve detection of LuaSec/OpenSSL capabilities

* mod_saslauth: Use a...