CVE-2011-2532 The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service (infinite loop) via invalid JSON data, as demonstrated by truncated da...
MediumCVSS 5.0
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service (infinite loop) via invalid JSON data, as demonstrated by truncated data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/prosody(Debian:12) | < 0.8.1-1 | 0.8.1-1 |
| debian/prosody(Debian:13) | < 0.8.1-1 | 0.8.1-1 |
| debian/prosody(Debian:14) | < 0.8.1-1 | 0.8.1-1 |
| prosody | = 0.8.0 | No fix listed |
References
- Debian Security Tracker CVE-2011-2532 vendor-advisory
- blog.prosody.im patch
- hg.prosody.im patch
- prosody.im patch