---

CVE-2021-32918 - log back

CVE-2021-32918 edited at 13 May 2021 15:08:48

References

https://prosody.im/security/advisory_20210512/#dos-via-insufficient-memory-consumption-controls https://hg.prosody.im/trunk/rev/db8e41eb6eff https://hg.prosody.im/trunk/rev/b0d8920ed5e5 https://hg.prosody.im/trunk/rev/929de6ade6b6 https://hg.prosody.im/trunk/rev/63fd4c8465fb https://hg.prosody.im/trunk/rev/1937b3c3efb5 https://hg.prosody.im/trunk/rev/3413fea9e6db - https://prosody.im/security/advisory_20210512/#undocumented-dialback-without-dialback-option-insecure - https://hg.prosody.im/trunk/rev/6be890ca492e - https://hg.prosody.im/trunk/rev/d0e9ffccdef9

CVE-2021-32918 edited at 13 May 2021 15:08:23

References

https://prosody.im/security/advisory_20210512/#dos-via-insufficient-memory-consumption-controls https://hg.prosody.im/trunk/rev/db8e41eb6eff https://hg.prosody.im/trunk/rev/b0d8920ed5e5 https://hg.prosody.im/trunk/rev/929de6ade6b6 https://hg.prosody.im/trunk/rev/63fd4c8465fb https://hg.prosody.im/trunk/rev/1937b3c3efb5 https://hg.prosody.im/trunk/rev/3413fea9e6db + https://prosody.im/security/advisory_20210512/#undocumented-dialback-without-dialback-option-insecure + https://hg.prosody.im/trunk/rev/6be890ca492e + https://hg.prosody.im/trunk/rev/d0e9ffccdef9

CVE-2021-32918 edited at 13 May 2021 15:06:23
Severity	- Unknown + High
Remote	- Unknown + Remote
Type	- Unknown + Denial of service
Description	+ A security issue was found in the Prosody.im XMPP server software before version 0.11.9. It was discovered that default settings leave Prosody susceptible to remote unauthenticated denial-of-service (DoS) attacks via memory exhaustion when running under Lua 5.2 or Lua 5.3.
References	+ https://prosody.im/security/advisory_20210512/#dos-via-insufficient-memory-consumption-controls + https://hg.prosody.im/trunk/rev/db8e41eb6eff + https://hg.prosody.im/trunk/rev/b0d8920ed5e5 + https://hg.prosody.im/trunk/rev/929de6ade6b6 + https://hg.prosody.im/trunk/rev/63fd4c8465fb + https://hg.prosody.im/trunk/rev/1937b3c3efb5 + https://hg.prosody.im/trunk/rev/3413fea9e6db
Notes	+ Workaround + ========== + + The issue can be partly mitigated using stricter settings for stanza size limits, rate limits and garbage collection parameters, see the referenced advisory for more details.

CVE-2021-32918 created at 13 May 2021 14:59:33