CVE-2021-32918 log

Source	CVE Red Hat MITRE NVD Debian Ubuntu SUSE Alpine Mageia CVE Details CIRCL Bugs Arch Linux Red Hat Gentoo SUSE GitHub Lists oss-security full-disclosure bugtraq Misc GitHub code web search
Severity	High
Remote	Yes
Type	Denial of service
Description	A security issue was found in the Prosody.im XMPP server software before version 0.11.9. It was discovered that default settings leave Prosody susceptible to remote unauthenticated denial-of-service (DoS) attacks via memory exhaustion when running under Lua 5.2 or Lua 5.3.

Group	Package	Affected	Fixed	Severity	Status	Ticket
AVG-1955	prosody	1:0.11.8-1	1:0.11.9-1	High	Fixed

Date	Advisory	Group	Package	Severity	Type
19 May 2021	ASA-202105-11	AVG-1955	prosody	High	multiple issues

References
https://prosody.im/security/advisory_20210512/#dos-via-insufficient-memory-consumption-controls https://hg.prosody.im/trunk/rev/db8e41eb6eff https://hg.prosody.im/trunk/rev/b0d8920ed5e5 https://hg.prosody.im/trunk/rev/929de6ade6b6 https://hg.prosody.im/trunk/rev/63fd4c8465fb https://hg.prosody.im/trunk/rev/1937b3c3efb5 https://hg.prosody.im/trunk/rev/3413fea9e6db

References

https://prosody.im/security/advisory_20210512/#dos-via-insufficient-memory-consumption-controls
https://hg.prosody.im/trunk/rev/db8e41eb6eff
https://hg.prosody.im/trunk/rev/b0d8920ed5e5
https://hg.prosody.im/trunk/rev/929de6ade6b6
https://hg.prosody.im/trunk/rev/63fd4c8465fb
https://hg.prosody.im/trunk/rev/1937b3c3efb5
https://hg.prosody.im/trunk/rev/3413fea9e6db

Notes
Workaround ========== The issue can be partly mitigated using stricter settings for stanza size limits, rate limits and garbage collection parameters, see the referenced advisory for more details.