You are here
Home > Preporuke > Sigurnosni nedostatak programskog paketa prosody

Sigurnosni nedostatak programskog paketa prosody

openSUSE Security Update: Security update for prosody
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:1627-1
Rating: moderate
References: #1094890
Cross-References: CVE-2018-10847
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for prosody fixes the following issues:

This security issue was fixed:

– CVE-2018-10847: Prevent insufficient validation of client-provided
parameters during XMPP stream restarts. Authenticated users may have
overriden the realm associated with their session, potentially bypassing
security policies and allowing impersonation (bsc#1094890).

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

– openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-597=1

Package List:

– openSUSE Leap 42.3 (i586 x86_64):

prosody-0.9.13-2.6.1
prosody-debuginfo-0.9.13-2.6.1
prosody-debugsource-0.9.13-2.6.1

References:

https://www.suse.com/security/cve/CVE-2018-10847.html
https://bugzilla.suse.com/1094890


To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

 

 

openSUSE Security Update: Security update for prosody
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:1632-1
Rating: moderate
References: #1094890
Cross-References: CVE-2018-10847
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for prosody to version 0.10.2 fixes the following issues:

This security issue was fixed:

– CVE-2018-10847: Prevent insufficient validation of client-provided
parameters during XMPP stream restarts. Authenticated users may have
overriden the realm associated with their session, potentially bypassing
security policies and allowing impersonation (bsc#1094890).

These non-security issues were fixed:

– mod_websocket: Store the request object on the session for use by other
modules
– mod_c2s: Avoid concatenating potential nil value
– core.certmanager: Allow all non-whitespace in service name
– mod_disco: Skip code specific to disco on user accounts
– mod_bosh: Store the normalized hostname on session
– MUC: Fix error logged when no persistent rooms present

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

– openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-596=1

Package List:

– openSUSE Leap 15.0 (x86_64):

prosody-0.10.2-lp150.3.6.2
prosody-debuginfo-0.10.2-lp150.3.6.2
prosody-debugsource-0.10.2-lp150.3.6.2

References:

https://www.suse.com/security/cve/CVE-2018-10847.html
https://bugzilla.suse.com/1094890


To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

Top
More in Preporuke
Sigurnosni nedostatak jezgre operacijskog sustava

Otkriven je sigurnosni nedostatak jezgre operacijskog sustava openSUSE. Otkriveni nedostatak potencijalnim napadačima omogućuju otkrivanje osjetljivih informacija. Savjetuje se ažuriranje izdanim...

Close