Bug 656998 (CVE-2018-10847)

Summary:	<net-im/prosody-0.9.14: insufficient stream header validation (CVE-2018-10847)
Product:	Gentoo Security	Reporter:	Kristian Fiskerstrand (RETIRED) <k_f>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	klausman, rafaelmartins, zx2c4
Priority:	Normal	Flags:	stable-bot: sanity-check+
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://www.openwall.com/lists/oss-security/2018/05/31/2
Whiteboard:	B4 [noglsa cve]
Package list:	=net-im/prosody-0.9.14	Runtime testing required:	---

Description Kristian Fiskerstrand (RETIRED) gentoo-dev

2018-05-31 19:47:58 UTC

CVE
:   CVE-2018-10847

Date
:   2018-05-31

Affected versions
:   0.9.x prior to 0.9.14, 0.10.x prior to 0.10.2. All prior series affected.

Fixed versions
:   0.9.14, 0.10.2

Description
-----------

Due to insufficient validation of client-provided parameters during XMPP
stream restarts, authenticated users may override the realm associated
with their session, potentially bypassing security policies and allowing
impersonation.

Comment 1 Tobias Klausmann (RETIRED) gentoo-dev

2018-06-01 13:42:59 UTC

prosody-0.10.2.ebuild and prosody-0.9.14.ebuild are in the tree, adding arches.

Arches, please test and mark stable:

=net-im/prosody-0.9.14

Comment 2 Agostino Sarubbo gentoo-dev

2018-06-02 17:36:16 UTC

amd64 stable

Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev

2018-06-06 23:27:42 UTC

x86 stable

Comment 4 Markus Meier gentoo-dev

2018-06-11 17:58:08 UTC

arm stable, all arches done.

Comment 5 Aaron Bauman (RETIRED) gentoo-dev

2018-06-11 18:00:21 UTC

@maintainer(s), please clean vulnerable.

Comment 6 Tobias Klausmann (RETIRED) gentoo-dev

2018-06-11 18:04:49 UTC

(In reply to Aaron Bauman from comment #5)
> @maintainer(s), please clean vulnerable.

Done.

Comment 7 Aaron Bauman (RETIRED) gentoo-dev

2018-06-11 18:09:58 UTC

(In reply to Tobias Klausmann from comment #6)
> (In reply to Aaron Bauman from comment #5)
> > @maintainer(s), please clean vulnerable.
> 
> Done.

Fastest cleanup ever!

Thanks, Tobias.