ejabberd 26.07

Search

Sign in

Table of contents

Contents:

Changes in SQL schemas

Security fixes

mod_invites: New pages to create invites and WebAdmin

mod_conversejs: Support ConverseJS 14

Erlang/OTP 27.0 as a soft minimum

Rebar/Rebar3: Update binaries to work with Erlang/OTP 26-29

ChangeLog

Acknowledgments

Improvements in ejabberd Business Edition

ejabberd 26.07 download & feedback

Changes in SQL schema

If you upgrade ejabberd from a previous release to 26.07, there are no changes in SQL schemas, but there is one for ejabberd Business Edition (see below).

Security fixes

This release contains fixes for those security issues:

It's possible to craft PLAIN auth request and authenticate as one user, but then open session for different one.

mod_caps persistent cache can be poisoned by using legacy version requests.This cache was only used to determine list of nodes that should trigger notifications in PubSub presence-based delivery.

SQL injection in mod_pubsub handling of paging requests.

Possible atom exhaustion that can be triggered by issuing REST requests to mod_http_api.

It was possible to make ejabberd send redirect response for OAuth requests to unvetted url. This required enabling ejabberd to act as OAuth provider (by adding request handler for ejabberd_oauth in http listener). As part of this fix we changed oauth_client_id_check default value to db.

using ejabberd as OAuth provider will be only allowed by clients

that were previously registered with oauth_add_client_password or oauth_add_client_implicit commands.

Tokens generated by mod_bosh, captcha, mod_auth_fast, mod_http_upload and mod_invites used not cryptographically strong random number generators.

Files server by mod_http_upload didn't have XSS prevention headers.

Issues in authentication of SIP requests.

Request to web_admin were lacking CSRF protection.

It was possible to skip captcha verification in mod_register_web.

mod_conversejs allowed putting unescaped value from url in page content.

mod_invites: New pages to create invites and WebAdmin

mod_invites now includes a startpage where regular users can use their account credentials to generate new account creation invites.

This is useful for people using XMPP clients that do no support that feature. The URL of that page is the root of mod_invites; you can find a link to that page in the bottom of WebAdmin left menu.

There are also new WebAdmin pages to view the existing invites, generate new invites, expire, delete ... Go and take a look at WebAdmin > "Virtual Hosts" > one of your hosts > "Invites"

mod_conversejs: Support ConverseJS 14

ConverseJS published version 14.0.0 recently, and it requires some changes in the web server. In this sense, mod_conversejs is updated to support ConverseJS 14, and also got other minor cosmetic improvements.

Erlang/OTP 27.0 as a soft minimum

Are you compiling ejabberd with Erlang/OTP 25 or 26? Then please try to update to Erlang/OTP 27, 28, or 29. For example, the ejabberd installers are compiled with Erlang/OTP 28.5.0.4.

ejabberd supports compilation with Erlang/OTP 25 and 26, and those versions are still tested in runtime.yml and weekly.yml, but those Erlang/OTP versions are not actively maintained anymore by Erlang/OTP.

Following the erlang security recommendation to Use Actively Maintained Versions of Erlang/OTP, from now ejabberd softly rejects compilation with Erlang/OTP lower than 27.

What does softly mean? If you really want to compile ejabberd with Erlang/OTP lower than 27 at your own risk, you can bypass that soft requirement by defining this option (Erlang/OTP 25.0 included Erlang Run-Time System 13.0, and that is the number to provide in that option):

./configure --with-min-erlang=13.0

Rebar/Rebar3: Update binaries to work with Erlang/OTP 26-29

ejabberd source code includes Rebar and Rebar3 binaries, in case you don't have installed in your system. But those programs only support four Erlang releases (26 up to 29).

If you want to compile ejabberd with Erlang 25, then you need to grab a compatible Rebar3 (or Rebar) binary: either install one from your operating system, or you can download the old binaries included with ejabberd 26.04 (those still supported Erlang 25):

https://github.com/processone/ejabberd/raw/26.04/rebar<br>https://github.com/processone/ejabberd/raw/26.04/rebar3

ChangeLog

Security fixes

This release contains fixes for those issues:

It's possible to craft PLAIN auth request and authenticate as one user, but then open session for different one.

mod_caps persistent cache can be poisoned by using legacy version requests.

This cache was only used to determine list of nodes that should trigger notifications in PubSub presence-based delivery.

SQL injection in mod_pubsub handling of paging requests.

Possible atom exhaustion that can be triggered by issuing REST requests to mod_http_api

It was possible to make ejabberd send redirect response for OAuth requests to unvetted url. This...