Candidate: CVE-2016-0756
PublicDate: 2016-01-29 20:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0756
 http://blog.prosody.im/prosody-0-9-10-released/
 https://prosody.im/security/advisory_20160127/
Description:
 The generate_dialback function in the mod_dialback module in Prosody before
 0.9.10 does not properly separate fields when generating dialback keys,
 which allows remote attackers to spoof XMPP network domains via a crafted
 stream id and domain name that is included in the target domain as a
 suffix.
Ubuntu-Description:
Notes:
Bugs:
Priority: medium
Discovered-by: Thijs Alkemade
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N [5.3 MEDIUM]

Patches_prosody:
upstream_prosody: released (0.9.10)
precise_prosody: ignored (reached end-of-life)
precise/esm_prosody: DNE (precise was needed)
trusty_prosody: ignored (reached end-of-life)
trusty/esm_prosody: DNE (trusty was needed)
vivid_prosody: released (0.9.7-2+deb8u3build0.15.04.1)
vivid/stable-phone-overlay_prosody: DNE
vivid/ubuntu-core_prosody: DNE
wily_prosody: ignored (reached end-of-life)
xenial_prosody: released (0.9.10-1)
yakkety_prosody: ignored (reached end-of-life)
zesty_prosody: ignored (reached end-of-life)
artful_prosody: ignored (reached end-of-life)
bionic_prosody: not-affected (0.9.10-1)
cosmic_prosody: not-affected (0.9.10-1)
disco_prosody: not-affected (0.9.10-1)
devel_prosody: not-affected (0.9.10-1)