CVE-2017-18265

NONE EPSS 74.7%
Published May 9, 20188y ago · Modified Jun 17, 20262w ago
Find Similar
Published May 9, 2018 8y ago
Last Modified Jun 17, 2026 2w ago

Description

Prosody before 0.10.0 allows remote attackers to cause a denial of service (application crash), related to an incompatibility with certain versions of the LuaSocket library, such as the lua-socket package from Debian stretch. The attacker needs to trigger a stream error. A crash can be observed in, for example, the c2s module.

Threat Intelligence

EPSS Exploit Probability
74.7% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 2

VendorProductVersionRange
prosodyprosody* <0.10.0
debiandebian_linux9.0any

References 5

  • bugs.debian.org https://bugs.debian.org/875829
    Issue TrackingMailing List
  • hg.prosody.im https://hg.prosody.im/0.9/rev/176b7f4e4ac9
    Patch
  • hg.prosody.im https://hg.prosody.im/0.9/rev/adfffc5b4e2a
    Patch
  • prosody.im https://prosody.im/issues/issue/987
    Vendor Advisory
  • debian.org https://www.debian.org/security/2018/dsa-4198
    Technical Description

Remediation