CVE-2017-18265

Debian Security Advisory 4198-1

Severity Score

7.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Prosody before 0.10.0 allows remote attackers to cause a denial of service (application crash), related to an incompatibility with certain versions of the LuaSocket library, such as the lua-socket package from Debian stretch. The attacker needs to trigger a stream error. A crash can be observed in, for example, the c2s module.

Prosody en versiones anteriores a la 0.10.0 permite que atacantes remotos provoquen una denegación de servicio (cierre inesperado de la aplicación). Esto está relacionado con una incompatibilidad con ciertas versiones de la biblioteca LuaSocket, como el paquete lua-socket de Debian stretch. El atacante necesita desencadenar un error de stream. Se puede observar un cierre inesperado, por ejemplo, en el módulo c2s.

Albert Dengg discovered that incorrect parsing ofmessages in the Prosody Jabber/XMPP server may result in denial of service.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2018-05-09 CVE Reserved
2018-05-09 CVE Published
2024-08-05 CVE Updated
2025-04-09 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (5)

URL	Tag	Source
https://bugs.debian.org/875829	Issue Tracking

URL	Date	SRC

URL	Date	SRC
https://hg.prosody.im/0.9/rev/176b7f4e4ac9	2019-10-03
https://hg.prosody.im/0.9/rev/adfffc5b4e2a	2019-10-03

URL	Date	SRC
https://prosody.im/issues/issue/987	2019-10-03
https://www.debian.org/security/2018/dsa-4198	2019-10-03

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Prosody Search vendor "Prosody"		Prosody Search vendor "Prosody" for product "Prosody"				< 0.10.0 Search vendor "Prosody" for product "Prosody" and version " < 0.10.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0"		-		Affected