CVE-2011-2532

Description

The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service (infinite loop) via invalid JSON data, as demonstrated by truncated data.

How to fix CVE-2011-2532

To remediate CVE-2011-2532, upgrade the affected package to a fixed version below.

• Debian/prosody—upgrade to 0.8.1-1 or later

Is CVE-2011-2532 being exploited?

Low — EPSS is 0.5%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 0.8.1-1

References (1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2011-2532