- Update to 0.11.9:
  Security: 
  * mod_limits, prosody.cfg.lua: Enable rate limits by default
  * certmanager: Disable renegotiation by default
  * mod_proxy65: Restrict access to local c2s connections by default
  * util.startup: Set more aggressive defaults for GC
  * mod_c2s, mod_s2s, mod_component, mod_bosh, mod_websockets: Set default stanza size limits
  * mod_authinternal{plain,hashed}: Use constant-time string comparison for secrets
  * mod_dialback: Remove dialback-without-dialback feature
  * mod_dialback: Use constant-time comparison with hmac
  Minor changes
  * util.hashes: Add constant-time string comparison (binding to CRYPTO_memcmp)
  * mod_c2s: Don’t throw errors in async code when connections are gone
  * mod_c2s: Fix traceback in session close when conn is nil
  * core.certmanager: Improve detection of LuaSec/OpenSSL capabilities
  * mod_saslauth: Use a defined SASL error
  * MUC: Add support for advertising muc#roomconfig_allowinvites in room disco#info
  * mod_saslauth: Don’t throw errors in async code when connections are gone
  * mod_pep: Advertise base pubsub feature (fixes #1632: mod_pep missing pubsub feature in disco)
  * prosodyctl check config: Add ‘gc’ to list of global options
  * prosodyctl about: Report libexpat version if known
  * util.xmppstream: Add API to dynamically configure the stanza size limit for a stream
  * util.set: Add is_set() to test if an object is a set
  * mod_http: Skip IP resolution in non-proxied case
  * mod_c2s: Log about missing conn on async state changes
  * util.xmppstream: Reduce internal default xmppstream limit to 1MB
- Relevant: https://prosody.im/security/advisory_20210512
  * boo#1186027: Prosody XMPP server advisory 2021-05-12
  * CVE-2021-32919
  * CVE-2021-32917

• Files Changed
• Browse Source