FEDORA-EPEL-2016-d4bdacdc4a

security update in Fedora EPEL 5 for prosody

Status: stable 3 years ago

Prosody 0.9.9

A summary of changes:

Security fixes

  • Fix path traversal vulnerability in mod_http_files (CVE-2016-1231)
  • Fix use of weak PRNG in generation of dialback secrets (CVE-2016-1232)

Bugs

  • Improve handling of CNAME records in DNS
  • Fix traceback when deleting a user in some configurations (issue #496)
  • MUC: restrict_room_creation could prevent users from joining rooms (issue #458)
  • MUC: fix occasional dropping of iq stanzas sent privately between occupants
  • Fix a potential memory leak in mod_pep

Additions

  • Add http:list() command to telnet to view active HTTP services
  • Simplify IPv4/v6 address selection code for outgoing s2s
  • Add support for importing SCRAM hashes from ejabberd

How to install

sudo dnf upgrade --advisory=FEDORA-EPEL-2016-d4bdacdc4a

Comments 8

This update has been submitted for testing by robert.

This update has been pushed to testing.

robert edited this update.

New build(s):

  • prosody-0.9.9-2.el5

Removed build(s):

  • prosody-0.9.9-1.el5

This update has been submitted for testing by robert.

This update has been pushed to testing.

This update has reached 14 days in testing and can be pushed to stable now if the maintainer wishes

This update has been submitted for stable by robert.

This update has been pushed to stable.

Content Type
RPM
Status
stable
Test Gating
Submitted by
Update Type
security
Update Severity
urgent
Karma
0
stable threshold: 1
unstable threshold: -3
Autopush
Enabled
Dates
submitted 3 years ago
in testing 3 years ago
in stable 3 years ago
modified 3 years ago

Related Bugs 2

00 #1296983 CVE-2016-1231 prosody: path traversal vulnerability in mod_http_files
00 #1296984 CVE-2016-1232 prosody: use of weak PRNG in generation of dialback secrets

Automated Test Results