Is CVE-2021-32921 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 2%.

What products does CVE-2021-32921 affect?

Tracked products affected include Lua. Check the version you run to see whether it is affected.

How do I fix CVE-2021-32921?

Apply the vendor fix in your normal patch cycle. Upgrade affected products to a fixed version.

CVE-2021-32921

Q: What is CVE-2021-32921?

CVE-2021-32921 is a medium-severity software vulnerability (CWE-362) with a CVSS score of 5.9. An issue was discovered in Prosody before 0.11.9. It does not use a constant-time algorithm for comparing certain secret strings when running under Lua 5.2 or later. This can potentially be used in a timing attack to reveal the contents of

MEDIUM severity · CVSS 5.9 · CWE-362

5.9CVSS MEDIUM

Summary

An issue was discovered in Prosody before 0.11.9. It does not use a constant-time algorithm for comparing certain secret strings when running under Lua 5.2 or later. This can potentially be used in a timing attack to reveal the contents of secret strings to an attacker.

Impact & exploitability

Attack vectorNetwork

Attack complexityHigh

Privileges requiredNone

User interactionNone

Confidentiality impactHigh

Integrity impactNone

Availability impactNone

Exploit probability (EPSS)2%

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products we track (1)

Lua

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
https://blog.prosody.im/prosody-0.11.9-released/Advisory
http://www.openwall.com/lists/oss-security/2021/05/14/2Advisory
http://www.openwall.com/lists/oss-security/2021/05/13/1Advisory
https://lists.debian.org/debian-lts-announce/2021/06/msg00016.htmlAdvisory
https://lists.debian.org/debian-lts-announce/2021/06/msg00018.htmlAdvisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6MFFBZWXKPZEVZNQSVJNCUE7WRF3T7DG/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GUN63AHEWB2WRROJHU3BVJRWLONCT2B7/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWJ2DG2DFJOEFEWOUN26IMYYWGSA2ZEE/