Test Kennung:	1.3.6.1.4.1.25623.1.0.852065
Kategorie:	SuSE Local Security Checks
Titel:	openSUSE: Security Advisory for prosody (openSUSE-SU-2018:1632-1)
Zusammenfassung:	The remote host is missing an update for the 'prosody'; package(s) announced via the openSUSE-SU-2018:1632-1 advisory.
Beschreibung:	Summary: The remote host is missing an update for the 'prosody' package(s) announced via the openSUSE-SU-2018:1632-1 advisory. Vulnerability Insight: This update for prosody to version 0.10.2 fixes the following issues: This security issue was fixed: - CVE-2018-10847: Prevent insufficient validation of client-provided parameters during XMPP stream restarts. Authenticated users may have overridden the realm associated with their session, potentially bypassing security policies and allowing impersonation (bsc#1094890). These non-security issues were fixed: - mod_websocket: Store the request object on the session for use by other modules - mod_c2s: Avoid concatenating potential nil value - core.certmanager: Allow all non-whitespace in service name - mod_disco: Skip code specific to disco on user accounts - mod_bosh: Store the normalized hostname on session - MUC: Fix error logged when no persistent rooms present Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'. Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-596=1 Affected Software/OS: prosody on openSUSE Leap 15.0. Solution: Please install the updated package(s). CVSS Score: 6.5 CVSS Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2018-10847
Copyright	Copyright (C) 2018 Greenbone Networks GmbH

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.