CVE-2011-2532: Medium severity prosody vulnerability
Published Jun 22, 2011
·Updated
The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service (infinite loop) via invalid JSON data, as demonstrated by truncated data.
Affected Software
1 affected component
Prosody prosody=0.8.0
Remediation
Patch Available
Patch Available
Patch Available
Event History
Jun 22, 2011
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-2532?
CVE-2011-2532 has been classified as a high-severity vulnerability due to its potential to cause denial of service.
2
How do I fix CVE-2011-2532?
To fix CVE-2011-2532, you need to upgrade Prosody to version 0.8.1 or later.
3
What type of attack does CVE-2011-2532 enable?
CVE-2011-2532 enables remote attackers to launch denial of service attacks through invalid JSON data.
4
Which versions of Prosody are affected by CVE-2011-2532?
CVE-2011-2532 affects Prosody version 0.8.0 and earlier versions.
5
What causes the vulnerability in CVE-2011-2532?
The vulnerability in CVE-2011-2532 is caused by the json.decode function entering an infinite loop when handling truncated or invalid JSON data.