Andre Bianchi

**Name of the Vulnerable Software and Affected Versions** Prosody versions prior to 0.11.9 **Description** An issue in Prosody allows an attacker to potentially reveal the contents of secret strings through a timing attack. This is due to the use of a non-constant-time algorithm for comparing certain secret strings when running under Lua 5.2 or later. The vulnerability can be exploited by a remote attacker to gain access to confidential data. **Recommendations** For versions prior to 0.11.9, update to version 0.11.9 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data until the update can be applied.