CVE-2017-18265

Name	CVE-2017-18265
Description	Prosody before 0.10.0 allows remote attackers to cause a denial of service (application crash), related to an incompatibility with certain versions of the LuaSocket library, such as the lua-socket package from Debian stretch. The attacker needs to trigger a stream error. A crash can be observed in, for example, the c2s module.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DSA-4198-1
Debian Bugs	875829

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
prosody (PTS)	buster, buster (security)	0.11.2-1+deb10u4	fixed
	bullseye (security), bullseye	0.11.9-2+deb11u2	fixed
	bookworm, sid	0.12.3-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
prosody	source	wheezy	(not affected)
prosody	source	jessie	(not affected)
prosody	source	stretch	0.9.12-2+deb9u1	DSA-4198-1
prosody	source	(unstable)	0.10.0-1		875829

Notes

[jessie] - prosody <not-affected> (Only exploitable with a LuaSocket version not in jessie)
[wheezy] - prosody <not-affected> (Vulnerable code not present)
https://prosody.im/issues/issue/987