CVE-2021-32921
published 2021-05-13CVE-2021-32921: An issue was discovered in Prosody before 0.11.9. It does not use a constant-time algorithm for comparing certain secret strings when running under Lua 5.2 or…
PriorityP333medium5.9CVSS 3.1
AVNACHPRNUINSUCHINAN
EPSS
1.60%
73.4th percentile
An issue was discovered in Prosody before 0.11.9. It does not use a constant-time algorithm for comparing certain secret strings when running under Lua 5.2 or later. This can potentially be used in a timing attack to reveal the contents of secret strings to an attacker.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | prosody | < prosody 0.11.9-1 (bookworm) | prosody 0.11.9-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| paloalto | cortex_xdr | — | — |
| prosody | prosody | < 0.11.9 | 0.11.9 |
| prosody | prosody | >= 0 < 0.11.9-1 | 0.11.9-1 |
| prosody | prosody | >= 0 < 0.11.9-1 | 0.11.9-1 |
| prosody | prosody | >= 0 < 0.11.9-1 | 0.11.9-1 |
| prosody | prosody | >= 0 < 0.11.9-1 | 0.11.9-1 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv5.9MEDIUM
vendor_debian5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vh63-h6gp-hw6w: An issue was discovered in Prosody before 0
ghsa_unreviewed·2022-05-24
CVE-2021-32921 [MEDIUM] CWE-362 GHSA-vh63-h6gp-hw6w: An issue was discovered in Prosody before 0
An issue was discovered in Prosody before 0.11.9. It does not use a constant-time algorithm for comparing certain secret strings when running under Lua 5.2 or later. This can potentially be used in a timing attack to reveal the contents of secret strings to an attacker.
OSV
CVE-2021-32921: An issue was discovered in Prosody before 0
osv·2021-05-13·CVSS 5.9
CVE-2021-32921 [MEDIUM] CVE-2021-32921: An issue was discovered in Prosody before 0
An issue was discovered in Prosody before 0.11.9. It does not use a constant-time algorithm for comparing certain secret strings when running under Lua 5.2 or later. This can potentially be used in a timing attack to reveal the contents of secret strings to an attacker.
Palo Alto
PAN-SA-2024-0014 Informational Bulletin: Impact of OSS CVEs in Cortex XDR Agent
vendor_paloalto·2024-11-07·CVSS 6.8
CVE-2014-0195 [MEDIUM] PAN-SA-2024-0014 Informational Bulletin: Impact of OSS CVEs in Cortex XDR Agent
PAN-SA-2024-0014 Informational Bulletin: Impact of OSS CVEs in Cortex XDR Agent
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to Cortex XDR Agent. While Cortex XDR Agent may include the
CVEs: CVE-2014-0195, CVE-2014-0224, CVE-2014-3509, CVE-2014-3512, CVE-2014-3513, CVE-2014-3567, CVE-2015-0209, CVE-2015-0292, CVE-2015-1789, CVE-2015-1791, CVE-2015-1793, CVE-2015-3194, CVE-2016-0705, CVE-2016-0797, CVE-2016-0798, CVE-2016-0799, CVE-2016-2105, CVE-2016-2106, CVE-2016-2108, CVE-2016-2109, CVE-2016-2176, CVE-2016-2177, CVE-2016-2179, CVE-2016-2180, CVE-2016-2181, CVE-2016-2182, CVE-2016-2183, CVE-2016-6302, CVE-2016-6303, CVE-2016-6304, CVE-2019-1551, CVE-2019-1552, CVE-2019-1559, CVE-2019-1563, CVE-2020-196
Debian
CVE-2021-32921: prosody - An issue was discovered in Prosody before 0.11.9. It does not use a constant-tim...
vendor_debian·2021·CVSS 5.9
CVE-2021-32921 [MEDIUM] CVE-2021-32921: prosody - An issue was discovered in Prosody before 0.11.9. It does not use a constant-tim...
An issue was discovered in Prosody before 0.11.9. It does not use a constant-time algorithm for comparing certain secret strings when running under Lua 5.2 or later. This can potentially be used in a timing attack to reveal the contents of secret strings to an attacker.
Scope: local
bookworm: resolved (fixed in 0.11.9-1)
bullseye: resolved (fixed in 0.11.9-1)
forky: resolved (fixed in 0.11.9-1)
sid: resolved (fixed in 0.11.9-1)
trixie: resolved (fixed in 0.11.9-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2021/05/13/1http://www.openwall.com/lists/oss-security/2021/05/14/2https://blog.prosody.im/prosody-0.11.9-released/https://lists.debian.org/debian-lts-announce/2021/06/msg00016.htmlhttps://lists.debian.org/debian-lts-announce/2021/06/msg00018.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6MFFBZWXKPZEVZNQSVJNCUE7WRF3T7DG/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GUN63AHEWB2WRROJHU3BVJRWLONCT2B7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWJ2DG2DFJOEFEWOUN26IMYYWGSA2ZEE/https://security.gentoo.org/glsa/202105-15https://www.debian.org/security/2021/dsa-4916http://www.openwall.com/lists/oss-security/2021/05/13/1http://www.openwall.com/lists/oss-security/2021/05/14/2https://blog.prosody.im/prosody-0.11.9-released/https://lists.debian.org/debian-lts-announce/2021/06/msg00016.htmlhttps://lists.debian.org/debian-lts-announce/2021/06/msg00018.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6MFFBZWXKPZEVZNQSVJNCUE7WRF3T7DG/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GUN63AHEWB2WRROJHU3BVJRWLONCT2B7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWJ2DG2DFJOEFEWOUN26IMYYWGSA2ZEE/https://security.gentoo.org/glsa/202105-15https://www.debian.org/security/2021/dsa-4916
2021-05-13
Published