CVE catalog

CVE-2017-18265

prosody: CVE-2017-18265

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.69% · Oct 25, 2026

Prosody before 0.10.0 allows remote attackers to cause a denial of service (application crash), related to an incompatibility with certain versions of the LuaSocket library, such as the lua-socket package from Debian stretch. The attacker needs to trigger a stream error. A crash can be observed in, for example, the c2s module.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianprosodysid13.0.7-1fixed
Debianprosodyforky13.0.7-1fixed
Debianprosodytrixie13.0.1-1+deb131ufixed
Debianprosodytrixie-security13.0.1-1+deb131ufixed
Debianprosodybookworm0.12.3-1+deb12u1fixed
Debianprosodybookworm-security0.12.3-1+deb12u1fixed
Ubuntuprosody16.040.9.8-1vulnerable
Ubuntuprosody16.040.9.9-1vulnerable
Ubuntuprosody16.040.9.10-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianprosodysourcesid0.10.0-1not yet assignedNot reported[875829]
Debianprosodysourceforky0.10.0-1not yet assignedNot reported[875829]
Debianprosodysourcetrixie0.10.0-1not yet assignedNot reported[875829]
Debianprosodysourcebookworm0.10.0-1not yet assignedNot reported[875829]

[Debian bug #875829]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [prosody]Unknown
    Details (6)

    • 0.12.3-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 0.10.0-1

      dsa · prosody · debian · bookworm; dsa · prosody · debian · 12

    • 0.12.3-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 0.10.0-1

      dsa · prosody · debian · bookworm; dsa · prosody · debian · 12

    • 13.0.1-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 0.10.0-1

      dsa · prosody · debian · bookworm; dsa · prosody · debian · 12

    • 13.0.1-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 0.10.0-1

      dsa · prosody · debian · bookworm; dsa · prosody · debian · 12

    • 0.12.3-1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 0.10.0-1

      dsa · prosody · debian · bookworm; dsa · prosody · debian · 12

    • 0.12.3-1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 0.10.0-1

      dsa · prosody · debian · bookworm; dsa · prosody · debian · 12

[Debian 13 (Trixie)]

  • [prosody]Unknown
    Details (6)

    • 13.0.1-1+deb131u · amd64 · trixie

      Fixed · Fixed: 0.10.0-1

      dsa · prosody · debian · 13

    • 13.0.1-1+deb131u · arm64 · trixie

      Fixed · Fixed: 0.10.0-1

      dsa · prosody · debian · 13

    • 13.0.6-1~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 0.10.0-1

      dsa · prosody · debian · 13

    • 13.0.6-1~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 0.10.0-1

      dsa · prosody · debian · 13

    • 13.0.1-1+deb131u · amd64 · trixie-security

      Fixed · Fixed: 0.10.0-1

      dsa · prosody · debian · 13

    • 13.0.1-1+deb131u · arm64 · trixie-security

      Fixed · Fixed: 0.10.0-1

      dsa · prosody · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]