PT-2021-4056 · Prosody+2 · Prosody+2

Published 2021-05-02 · Updated 2024-12-08 · CVE-2021-32919

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Prosody versions prior to 0.11.9

Description The issue is related to the undocumented dialback without dialback option in the mod dialback module, which enables an experimental feature for server-to-server authentication. This option does not correctly authenticate remote server certificates, allowing a remote server to impersonate another server when the option is enabled. The vulnerability is associated with incorrect authentication of remote server certificates.

Recommendations For versions prior to 0.11.9, update to version 0.11.9 or later to resolve the issue. As a temporary workaround, consider disabling the dialback without dialback option in the mod dialback module until a patch is available. Restrict access to the mod dialback module to minimize the risk of exploitation.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2021-1808

ALT-PU-2021-2611

ALT-PU-2024-16554

BDU:2021-04584

CVE-2021-32919

DSA-4916-1

DSA-4916-2

OPENSUSE-SU-2021:0728-1

OPENSUSE-SU-2021:0751-1

OPENSUSE-SU-2021_0728-1

OPENSUSE-SU-2024:11197-1

Affected Products

Alt Linux

Prosody

Suse

References · 36

• https://cve.org/CVERecord?id=CVE-2021-32919 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32919 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-32919 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32919 · Security Note
• https://blog.prosody.im/prosody-0.11.9-released · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0728-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32919 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11197-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04584 · Security Note
• https://osv.dev/vulnerability/DSA-4916-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0751-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWJ2DG2DFJOEFEWOUN26IMYYWGSA2ZEE · Vendor Advisory
• https://debian.org/security/2021/dsa-4916 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4916-2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6MFFBZWXKPZEVZNQSVJNCUE7WRF3T7DG · Vendor Advisory