CVE-2011-2532

The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service (infinite loop) via invalid JSON data, as demonstrated by truncated data.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:N/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 66%
VendorProductVersion
prosodyprosody
0.8.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
prosody
bullseye (security)
0.11.9-2+deb11u2
fixed
bullseye
0.11.9-2+deb11u2
fixed
squeeze
no-dsa
bookworm
0.12.3-1
fixed
trixie
0.12.4-1
fixed
sid
0.12.4-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
prosody
natty
not-affected
maverick
not-affected
lucid
not-affected
hardy
dne
Common Weakness Enumeration
References
http://blog.prosody.im/prosody-0-8-1-released/
http://hg.prosody.im/0.8/rev/20979f124ad9
http://prosody.im/doc/release/0.8.1
http://blog.prosody.im/prosody-0-8-1-released/
http://hg.prosody.im/0.8/rev/20979f124ad9
http://prosody.im/doc/release/0.8.1