Today brings an important security release for both our stable branches. This fixes a cross-host authentication vulnerability, CVE-2018-10847.
The issue affects Prosody instances that have multiple virtual hosts (including anonymous authenticated hosts). All versions of Prosody before 0.9.14 and 0.10.2 are affected.
A full security advisory is available at https://prosody.im/security/advisory_20180531
Changes Summary of all changes in this release:
Security mod_c2s: Do not allow the stream ‘to’ to change across stream restarts (fixes #1147) Minor changes mod_websocket: Store the request object on the session for use by other modules (fixes #1153) mod_c2s: Avoid concatenating potential nil value (fixes #753) core.
Zash
All umeHack social content and data are available under the