Information Disclosure

2021-05-1422:23:34

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.004 Low

EPSS

Percentile

72.4%

JSON

prosody is vulnerable to information disclosure. The vulnerability exists as it does not use a constant-time algorithm for comparing secret strings when running under Lua 5.2 or later, allowing timing attacks to reveal the contents of secret strings.

CPENameOperatorVersion
prosody:edgeeq0.11.4-r0
prosody:edgeeq0.11.8-r0
prosody:edgeeq0.11.5-r0
prosody:3.13eq0.11.7-r0
prosody:sideq0.11.7-1
prosody:sideq0.11.8-1
prosody:3.12eq0.11.5-r0
prosody:bullseyeeq0.11.7-1
prosody:stretcheq0.9.12-2+deb9u2
prosody:edgeeq0.11.4-r0

Name	Operator	Version
prosody:edge	eq	0.11.4-r0
prosody:edge	eq	0.11.8-r0
prosody:edge	eq	0.11.5-r0
prosody:3.13	eq	0.11.7-r0
prosody:sid	eq	0.11.7-1
prosody:sid	eq	0.11.8-1
prosody:3.12	eq	0.11.5-r0
prosody:bullseye	eq	0.11.7-1
prosody:stretch	eq	0.9.12-2+deb9u2
prosody:edge	eq	0.11.4-r0