bugtraq - [SECURITY] [DSA 3463-1] prosody security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20160131181548.GA3122@pisco.westfalen.local>
Date: Sun, 31 Jan 2016 19:15:48 +0100
From: Moritz Muehlenhoff <jmm@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3463-1] prosody security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3463-1                   security@...ian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
January 31, 2016                      https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : prosody
CVE ID         : CVE-2016-0756

It was discovered that insecure handling of dialback keys may allow
a malicious XMPP server to impersonate another server.

For the oldstable distribution (wheezy), this problem has been fixed
in version 0.8.2-4+deb7u4.

For the stable distribution (jessie), this problem has been fixed in
version 0.9.7-2+deb8u3.

For the unstable distribution (sid), this problem has been fixed in
version 0.9.10-1.

We recommend that you upgrade your prosody packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJWrk8AAAoJEBDCk7bDfE42wSwP/jJs8ijTNTZ7Qby+1XcKz8Ce
/E9qRXpylGIEGqgZZchqOPV2CUhCBH8W85AJeyd907b5iNMs56rPxYRWAJQaU4uZ
NkN4pVpDRNr1myogt+tDFhvXW14QvREfCK4skvbZcQA0IBgKkDKGzdfAqs05wjhN
mWpkNy4fUIRJppugXhHdAjuZrKXfRB8SVIUutddhVYKDJBn28HCi8KQ1hCIrCFoa
a6FAT/+MSSBn3Awgx9hcNfMtER52+1S92fucuBLROTzh6UDqxqODdnzXuFU9W93K
d/+iW/eaTxu9NVeSXb8hj1N/Pp1g//9sC8V8OdX/K3xDo0gTYBpe7ujGPCNdslhP
r+89hiN1IwuzLg/QCL1V8EYr7jMCWB/z5WfXxQ54Qb6PhHm0GACkpyKFackxSVPd
rncsIUbdJKwmOxQHPm2azFgumQvDGdpu9cMPfrsfSpKY109dQl9nRudeMcAxbFnD
TpiQ1sJxZ2V7l80ah0SaXTt2PRtRU6KCvL0FbKDhxt8fFFkXlJ9Hk+6dIKdzhfha
bIkvqzXiaopCJGHQ942LunkiBoL6TRGmOr4UZGPVIw1yY4j35omZhq1vhZfqDsi+
MCSVUR8n0f+MLNUwZ2Jc2ad6VrjrZuZS8Aohgg/aUsulG5yZM89naT0S3f3YKcCG
DvVBRcN2sB8T7I2+0FvW
=bLSK
-----END PGP SIGNATURE-----