CVE-2021-32919: High severity Prosody prosody vulnerability
An issue was discovered in Prosody before 0.11.9. The undocumented dialbackwithoutdialback option in moddialback enables an experimental feature for server-to-server authentication. It does not correctly authenticate remote server certificates, allowing a remote server to impersonate another server (when this option is enabled).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/prosodyto a version that resolves this vulnerability.Fixed in 0.11.2-1+deb10u4Fixed in 0.11.9-2+deb11u2Fixed in 0.12.3-1Fixed in 0.12.4-1 - Upgrade
Upgrade
alpine/prosodyto a version that resolves this vulnerability.Fixed in 0.11.9-r0 - Upgrade
Upgrade
Prosodyto a version that resolves this vulnerability.Fixed in 0.11.9 - Configuration
Disable the undocumented dialback_without_dialback option.
mod_dialback dialback_without_dialback = disabled
Event History
Frequently Asked Questions
What is CVE-2021-32919?
CVE-2021-32919 is an issue discovered in Prosody, a XMPP server, before version 0.11.9.
What is the severity of CVE-2021-32919?
CVE-2021-32919 has a severity level of high with a CVSS score of 7.5.
How does CVE-2021-32919 affect Prosody?
CVE-2021-32919 affects Prosody versions before 0.11.9.
What is the vulnerability in CVE-2021-32919?
The vulnerability in CVE-2021-32919 is the undocumented dialback_without_dialback option in mod_dialback, which enables an experimental feature for server-to-server authentication.
How can I fix CVE-2021-32919 in Prosody?
To fix CVE-2021-32919 in Prosody, you should update to version 0.11.9 or later.