Information Exposure Through Timing Discrepancy in Prosody - CVE-2021-32921
Published: May 17, 2021
Vulnerability identifier: #VU53313
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-32921
CWE-ID: CWE-208
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the application does not use a constant-time algorithm for comparing certain secret strings when running under Lua 5.2 or later. This can potentially be used in a timing attack to reveal the contents of secret strings to an attacker.
Affected software
Prosody
Gentoo Linux
Arch Linux
Fedora
prosody (Debian package)
prosody
Gentoo Linux
Arch Linux
Fedora
prosody (Debian package)
prosody
How to mitigate CVE-2021-32921
Install updates from vendor's website.
Prosody - update to 0.11.9
prosody (Debian package) - update to 0.11.2-1+deb10u1
prosody - addressed in versions 0.11.9-1.el7, 0.11.9-1.el8, 0.11.9-1.fc32, 0.11.9-1.fc33, 0.11.9-1.fc34
prosody (Debian package) - update to 0.11.2-1+deb10u1
prosody - addressed in versions 0.11.9-1.el7, 0.11.9-1.el8, 0.11.9-1.fc32, 0.11.9-1.fc33, 0.11.9-1.fc34