Alerts This Week
Warning Icon 1 700
Alerts This Week
Warning Icon 1 700

openSUSE: 2021:0751-1 Important: Prosody Security Update

opensuse
Calendar Grey May 18, 2021
Dist Opensuse Esm H88
A new release tackling various vulnerabilities in Prosody for openSUSE has been issued, featuring crucial patches and improvements.
An update that fixes four vulnerabilities is now available

Description

This update for prosody fixes the following issues:

prosody was updated to 0.11.9:

Security:

* mod_limits, prosody.cfg.lua: Enable rate limits by default

* certmanager: Disable renegotiation by default

* mod_proxy65: Restrict access to local c2s connections by default

* util.startup: Set more aggressive defaults for GC

* mod_c2s, mod_s2s, mod_component, mod_bosh, mod_websockets: Set default

stanza size limits

* mod_authinternal{plain,hashed}: Use constant-time string comparison for

secrets

* mod_dialback: Remove dialback-without-dialback feature

* mod_dialback: Use constant-time comparison with hmac

Minor changes:

* util.hashes: Add constant-time string comparison (binding to

CRYPTO_memcmp)

* mod_c2s: Don???t throw errors in async code when connections are gone

* mod_c2s: Fix traceback in session close when conn is nil

* core.certmanager: Improve detection of LuaSec/OpenSSL capabilities

* mod_saslauth: Use a...

Read the Full Advisory

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Backports SLE-15-SP2:

zypper in -t patch openSUSE-2021-751=1

Package List

- openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64):

prosody-0.11.9-bp152.2.3.1

References

https://www.suse.com/security/cve/CVE-2021-32917.html

https://www.suse.com/security/cve/CVE-2021-32918.html

https://www.suse.com/security/cve/CVE-2021-32919.html

https://www.suse.com/security/cve/CVE-2021-32920.html

https://bugzilla.suse.com/1186027

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2021:0751-1
Rating: important
Affected Products: openSUSE Backports SLE-15-SP2 .

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here