CVE-2021-32917

An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither of the users has an XMPP account on the local server, allowing unrestricted use of the server's bandwidth.

An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither of the users has an XMPP account on the local server, allowing unrestricted use of the server's bandwidth.

This update for prosody fixes the following issues:

prosody was updated to 0.11.9:

Security:

• mod_limits, prosody.cfg.lua: Enable rate limits by default
• certmanager: Disable renegotiation by default
• mod_proxy65: Restrict access to local c2s connections by default
• util.startup: Set more aggressive defaults for GC
• mod_c2s, mod_s2s, mod_component, mod_bosh, mod_websockets: Set default stanza size limits
• mod_authinternal{plain,hashed}: Use constant-time string comparison for secrets
• mod_dialback: Remove dialback-without-dialback feature
• mod_dialback: Use constant-time comparison with hmac

Minor changes:

• util.hashes: Add constant-time string comparison (binding to CRYPTO_memcmp)
• mod_c2s: Don’t throw errors in async code when connections are gone
• mod_c2s: Fix traceback in session close when conn is nil
• core.certmanager: Improve detection of LuaSec/OpenSSL capabilities
• mod_saslauth: Use a defined SASL error
• MUC: Add support for advertising muc#roomconfig_allowinvites in room disco#info
• mod_saslauth: Don’t throw errors in async code when connections are gone
• mod_pep: Advertise base pubsub feature (fixes #1632: mod_pep missing pubsub feature in disco)
• prosodyctl check config: Add ‘gc’ to list of global options
• prosodyctl about: Report libexpat version if known
• util.xmppstream: Add API to dynamically configure the stanza size limit for a stream
• util.set: Add is_set() to test if an object is a set
• mod_http: Skip IP resolution in non-proxied case
• mod_c2s: Log about missing conn on async state changes
• util.xmppstream: Reduce internal default xmppstream limit to 1MB

Relevant: https://prosody.im/security/advisory_20210512

• boo#1186027: Prosody XMPP server advisory 2021-05-12
• CVE-2021-32919
• CVE-2021-32917
• CVE-2021-32917
• CVE-2021-32920
• CVE-2021-32918

Update to 0.11.8:

Security:

• mod_saslauth: Disable ‘tls-unique’ channel binding with TLS 1.3 (#1542)

Fixes and improvements:

• net.websocket.frames: Improve websocket masking performance by using the new util.strbitop
• util.strbitop: Library for efficient bitwise operations on strings

Minor changes:

• MUC: Correctly advertise whether the subject can be changed (#1155)
• MUC: Preserve disco ‘node’ attribute (or lack thereof) in responses (#1595)
• MUC: Fix logic bug causing unnecessary presence to be sent (#1615)
• mod_bosh: Fix error if client tries to connect to component (#425)
• mod_bosh: Pick out the ‘wait’ before checking it instead of earlier
• mod_pep: Advertise base PubSub feature (#1632)
• mod_pubsub: Fix notification stanza type setting (#1605)
• mod_s2s: Prevent keepalives before client has established a stream
• net.adns: Fix bug that sent empty DNS packets (#1619)
• net.http.server: Don’t send Content-Length on 1xx/204 responses (#1596)
• net.websocket.frames: Fix length calculation bug (#1598)
• util.dbuffer: Make length API in line with Lua strings
• util.dbuffer: Optimize substring operations
• util.debug: Fix locals being reported under wrong stack frame in some cases
• util.dependencies: Fix check for Lua bitwise operations library (#1594)
• util.interpolation: Fix combination of filters and fallback values #1623
• util.promise: Preserve tracebacks
• util.stanza: Reject ASCII control characters (#1606)
• timers: Ensure timers can’t block other processing (#1620)

Update to 0.11.7:

Security:

• mod_websocket: Enforce size limits on received frames (fixes #1593)

Fixes and improvements:

• mod_c2s, mod_s2s: Make stanza size limits configurable
• Add configuration options to control Lua garbage collection parameters
• net.http: Backport SNI support for outgoing HTTP requests (#409)
• mod_websocket: Process all data in the buffer on close frame and connection errors (fixes #1474, #1234)
• util.indexedbheap: Fix heap data structure corruption, causing some timers to fail after a reschedule (fixes #1572)

Update to 0.11.6:

Fixes and improvements:

• mod_storage_internal: Fix error in time…

This update for prosody fixes the following issues:

prosody was updated to 0.11.9:

Security:

• mod_limits, prosody.cfg.lua: Enable rate limits by default
• certmanager: Disable renegotiation by default
• mod_proxy65: Restrict access to local c2s connections by default
• util.startup: Set more aggressive defaults for GC
• mod_c2s, mod_s2s, mod_component, mod_bosh, mod_websockets: Set default stanza size limits
• mod_authinternal{plain,hashed}: Use constant-time string comparison for secrets
• mod_dialback: Remove dialback-without-dialback feature
• mod_dialback: Use constant-time comparison with hmac

Minor changes:

• util.hashes: Add constant-time string comparison (binding to CRYPTO_memcmp)
• mod_c2s: Don’t throw errors in async code when connections are gone
• mod_c2s: Fix traceback in session close when conn is nil
• core.certmanager: Improve detection of LuaSec/OpenSSL capabilities
• mod_saslauth: Use a defined SASL error
• MUC: Add support for advertising muc#roomconfig_allowinvites in room disco#info
• mod_saslauth: Don’t throw errors in async code when connections are gone
• mod_pep: Advertise base pubsub feature (fixes #1632: mod_pep missing pubsub feature in disco)
• prosodyctl check config: Add ‘gc’ to list of global options
• prosodyctl about: Report libexpat version if known
• util.xmppstream: Add API to dynamically configure the stanza size limit for a stream
• util.set: Add is_set() to test if an object is a set
• mod_http: Skip IP resolution in non-proxied case
• mod_c2s: Log about missing conn on async state changes
• util.xmppstream: Reduce internal default xmppstream limit to 1MB

Relevant: https://prosody.im/security/advisory_20210512

• boo#1186027: Prosody XMPP server advisory 2021-05-12
• CVE-2021-32919
• CVE-2021-32917
• CVE-2021-32917
• CVE-2021-32920
• CVE-2021-32918

Update to 0.11.8:

Security:

• mod_saslauth: Disable ‘tls-unique’ channel binding with TLS 1.3 (#1542)

Fixes and improvements:

• net.websocket.frames: Improve websocket masking performance by using the new util.strbitop
• util.strbitop: Library for efficient bitwise operations on strings

Minor changes:

• MUC: Correctly advertise whether the subject can be changed (#1155)
• MUC: Preserve disco ‘node’ attribute (or lack thereof) in responses (#1595)
• MUC: Fix logic bug causing unnecessary presence to be sent (#1615)
• mod_bosh: Fix error if client tries to connect to component (#425)
• mod_bosh: Pick out the ‘wait’ before checking it instead of earlier
• mod_pep: Advertise base PubSub feature (#1632)
• mod_pubsub: Fix notification stanza type setting (#1605)
• mod_s2s: Prevent keepalives before client has established a stream
• net.adns: Fix bug that sent empty DNS packets (#1619)
• net.http.server: Don’t send Content-Length on 1xx/204 responses (#1596)
• net.websocket.frames: Fix length calculation bug (#1598)
• util.dbuffer: Make length API in line with Lua strings
• util.dbuffer: Optimize substring operations
• util.debug: Fix locals being reported under wrong stack frame in some cases
• util.dependencies: Fix check for Lua bitwise operations library (#1594)
• util.interpolation: Fix combination of filters and fallback values #1623
• util.promise: Preserve tracebacks
• util.stanza: Reject ASCII control characters (#1606)
• timers: Ensure timers can’t block other processing (#1620)

Update to 0.11.7:

Security:

• mod_websocket: Enforce size limits on received frames (fixes #1593)

Fixes and improvements:

• mod_c2s, mod_s2s: Make stanza size limits configurable
• Add configuration options to control Lua garbage collection parameters
• net.http: Backport SNI support for outgoing HTTP requests (#409)
• mod_websocket: Process all data in the buffer on close frame and connection errors (fixes #1474, #1234)
• util.indexedbheap: Fix heap data structure corruption, causing some timers to fail after a reschedule (fixes #1572)

Update to 0.11.6:

Fixes and improvements:

• mod_storage_internal: Fix error in time…

These are all security issues fixed in the prosody-0.11.10-1.2 package on the GA media of openSUSE Tumbleweed.