PT-2018-10138 · Prosody+3 · Prosody+3

Princess Pepperoni · Published 2018-06-02 · Updated 2021-03-15 · CVE-2018-10847

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Prosody versions prior to 0.10.2 Prosody version 0.9.14

Description The issue allows for an authentication bypass. It occurs because Prosody does not verify that the virtual host associated with a user session remains the same across stream restarts. This means a user may authenticate to one XMPP host and then migrate their authenticated session to another XMPP host of the same Prosody instance.

Recommendations For versions prior to 0.10.2, update to version 0.10.2 or later. For version 0.9.14, consider upgrading to a newer version to mitigate the risk, as 0.9.14 is specifically mentioned as vulnerable.

Fix

Improper Authentication

Weakness Enumeration

CWE-592

CWE-287

Related Identifiers

ALT-PU-2018-2853

CVE-2018-10847

DSA-4216-1

OPENSUSE-SU-2018_1627-1

OPENSUSE-SU-2018_1632-1

USN-4834-1

Affected Products

Alt Linux

Prosody

Suse

Ubuntu

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2018-10847 · Security Note
• https://osv.dev/vulnerability/DSA-4216-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-10847 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-10847 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-10847 · Vendor Advisory
• https://prosody.im/security/advisory_20180531 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10847 · Vendor Advisory
• https://blog.prosody.im/prosody-0-10-2-security-release · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4834-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4834-1 · Vendor Advisory
• https://issues.prosody.im/1147 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-10847 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-10847 · Vendor Advisory
• https://debian.org/security/2018/dsa-4216 · Vendor Advisory
• https://prosody.im/security/advisory_20180531/issue1147-0.9.patch · Note