|Category:||SuSE Local Security Checks|
|Title:||SuSE Update for prosody openSUSE-SU-2018:1632-1 (prosody)|
|Summary:||The remote host is missing an update for the 'prosody'; package(s) announced via the openSUSE-SU-2018:1632_1 advisory.|
The remote host is missing an update for the 'prosody'
package(s) announced via the openSUSE-SU-2018:1632_1 advisory.
This update for prosody to version 0.10.2 fixes the following issues:
This security issue was fixed:
- CVE-2018-10847: Prevent insufficient validation of client-provided
parameters during XMPP stream restarts. Authenticated users may have
overridden the realm associated with their session, potentially bypassing
security policies and allowing impersonation (bsc#1094890).
These non-security issues were fixed:
- mod_websocket: Store the request object on the session for use by other
- mod_c2s: Avoid concatenating potential nil value
- core.certmanager: Allow all non-whitespace in service name
- mod_disco: Skip code specific to disco on user accounts
- mod_bosh: Store the normalized hostname on session
- MUC: Fix error logged when no persistent rooms present
To install this openSUSE Security Update use the SUSE recommended
like YaST online_update or 'zypper patch'.
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2018-596=1
prosody on openSUSE Leap 15.0.
Please install the updated package(s).
Common Vulnerability Exposure (CVE) ID: CVE-2018-10847|
|Copyright||Copyright (C) 2018 Greenbone Networks GmbH|
|This is only one of 72306 vulnerability tests in our test suite. Find out more about running a complete security audit.|
To run a free test of this vulnerability against your system, register below.