DEBIAN-CVE-2016-0756

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2016-0756
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2016-0756.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2016-0756
Upstream
Published
2016-01-29T20:59:06.560Z
Modified
2025-11-14T04:01:30.922721Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

The generatedialback function in the moddialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix.

References

Affected packages

Debian:11 / prosody

Package

Name
prosody
Purl
pkg:deb/debian/prosody?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.10-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / prosody

Package

Name
prosody
Purl
pkg:deb/debian/prosody?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.10-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / prosody

Package

Name
prosody
Purl
pkg:deb/debian/prosody?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.10-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / prosody

Package

Name
prosody
Purl
pkg:deb/debian/prosody?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.10-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}