CVE-2018-10847

NameCVE-2018-10847
Descriptionprosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtual host associated with a user session remained the same across stream restarts. A user may authenticate to XMPP host A and migrate their authenticated session to XMPP host B of the same Prosody instance.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-4216-1
NVD severitymedium (attack range: remote)
Debian Bugs900524

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
prosody (PTS)jessie (security), jessie0.9.7-2+deb8u4fixed
stretch (security), stretch0.9.12-2+deb9u2fixed
buster0.10.2-1fixed
sid0.11.1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
prosodysource(unstable)0.10.2-1medium900524
prosodysourcejessie0.9.7-2+deb8u4mediumDSA-4216-1
prosodysourcestretch0.9.12-2+deb9u2mediumDSA-4216-1

Notes

https://issues.prosody.im/1147
https://blog.prosody.im/prosody-0-10-2-security-release/
https://prosody.im/security/advisory_20180531/issue1147-0.10.1.patch (0.10.1)
https://prosody.im/security/advisory_20180531/issue1147-0.9.patch (0.9.x)

Search for package or bug name: Reporting problems