ejabberd

ejabberd 26.07

We are publishing this security release ejabberd 26.07, which includes several security fixes, some improvements and other minor bugfixes. It is strongly encouraged that you update ejabberd as soon as possible.

Jérôme Sautret
· 6 min read
Send by email

Contents:

Changes in SQL schema

If you upgrade ejabberd from a previous release to 26.07, there are no changes in SQL schemas, but there is one for ejabberd Business Edition (see below).

Security fixes

This release contains fixes for those security issues:

  • It's possible to craft PLAIN auth request and authenticate as one user, but then open session for different one.
  • mod_caps persistent cache can be poisoned by using legacy version requests.This cache was only used to determine list of nodes that should trigger notifications in PubSub presence-based delivery.
  • SQL injection in mod_pubsub handling of paging requests.
  • Possible atom exhaustion that can be triggered by issuing REST requests to mod_http_api.
  • It was possible to make ejabberd send redirect response for OAuth requests to unvetted url. This required enabling ejabberd to act as OAuth provider (by adding request handler for ejabberd_oauth in http listener). As part of this fix we changed oauth_client_id_check default value to db.
  • using ejabberd as OAuth provider will be only allowed by clients
    that were previously registered with oauth_add_client_password or oauth_add_client_implicit commands.
  • Tokens generated by mod_bosh, captcha, mod_auth_fast, mod_http_upload and mod_invites used not cryptographically strong random number generators.
  • Files server by mod_http_upload didn't have XSS prevention headers.
  • Issues in authentication of SIP requests.
  • Request to web_admin were lacking CSRF protection.
  • It was possible to skip captcha verification in mod_register_web.
  • mod_conversejs allowed putting unescaped value from url in page content.

mod_invites: New pages to create invites and WebAdmin

mod_invites now includes a startpage where regular users can use their account credentials to generate new account creation invites.

This is useful for people using XMPP clients that do no support that feature. The URL of that page is the root of mod_invites; you can find a link to that page in the bottom of WebAdmin left menu.

There are also new WebAdmin pages to view the existing invites, generate new invites, expire, delete ... Go and take a look at WebAdmin > "Virtual Hosts" > one of your hosts > "Invites"

mod_conversejs: Support ConverseJS 14

ConverseJS published version 14.0.0 recently, and it requires some changes in the web server. In this sense, mod_conversejs is updated to support ConverseJS 14, and also got other minor cosmetic improvements.

Erlang/OTP 27.0 as a soft minimum

Are you compiling ejabberd with Erlang/OTP 25 or 26? Then please try to update to Erlang/OTP 27, 28, or 29. For example, the ejabberd installers are compiled with Erlang/OTP 28.5.0.4.

ejabberd supports compilation with Erlang/OTP 25 and 26, and those versions are still tested in runtime.yml and weekly.yml, but those Erlang/OTP versions are not actively maintained anymore by Erlang/OTP.

Following the erlang security recommendation to Use Actively Maintained Versions of Erlang/OTP, from now ejabberd softly rejects compilation with Erlang/OTP lower than 27.

What does softly mean? If you really want to compile ejabberd with Erlang/OTP lower than 27 at your own risk, you can bypass that soft requirement by defining this option (Erlang/OTP 25.0 included Erlang Run-Time System 13.0, and that is the number to provide in that option):

./configure --with-min-erlang=13.0

Rebar/Rebar3: Update binaries to work with Erlang/OTP 26-29

ejabberd source code includes Rebar and Rebar3 binaries, in case you don't have installed in your system. But those programs only support four Erlang releases (26 up to 29).

If you want to compile ejabberd with Erlang 25, then you need to grab a compatible Rebar3 (or Rebar) binary: either install one from your operating system, or you can download the old binaries included with ejabberd 26.04 (those still supported Erlang 25):

https://github.com/processone/ejabberd/raw/26.04/rebar
https://github.com/processone/ejabberd/raw/26.04/rebar3

ChangeLog

Security fixes

This release contains fixes for those issues:

  • It's possible to craft PLAIN auth request and authenticate as one user, but then open session for different one.
  • mod_caps persistent cache can be poisoned by using legacy version requests.
    This cache was only used to determine list of nodes that should trigger notifications in PubSub presence-based delivery.
  • SQL injection in mod_pubsub handling of paging requests.
  • Possible atom exhaustion that can be triggered by issuing REST requests to mod_http_api
  • It was possible to make ejabberd send redirect response for OAuth requests to unvetted url. This required enabling ejabberd to act as OAuth provider (by adding request handler for ejabberd_oauth in http listener). As part of this fix we changed oauth_client_id_check default value to db
  • using ejabberd as OAuth provider will be only allowed by clients
    that were previously registered with oauth_add_client_password or oauth_add_client_implicit commands.
  • Tokens generated by mod_bosh, captcha, mod_auth_fast, mod_http_upload and mod_invites used not cryptographically strong random number generators.
  • Files server by mod_http_upload didn't have XSS prevention headers.
  • Issues in authentication of SIP requests.
  • Request to web_admin were lacking CSRF protection.
  • It was possible to skip captcha verification in mod_register_web.
  • mod_conversejs allowed putting unescaped value from url in page content.

Core

  • Fixes delete_old_messages_batch command when used on pgsql
  • Adds export_db_ext which allows exporting db content to json files
  • Use constant time functions when doing password checks
  • Optimize room_unused_* commands when room hibernation is configured
  • We no longer add flag requesting client certificate for tls connections
    where certificate authentication is not enabled

Modules

  • mod_auth_fast: Fixes exception for session that didn't set user agent
  • mod_invites: Add page for creating invites.
  • mod_invites: Fix generation of CSRF tokens.
  • mod_invites: Update to changes in latest XEP-0401
  • mod_http_upload: Attach custom headers from config when serving files.

Full Changelog

https://github.com/processone/ejabberd/compare/26.04...26.07

Acknowledgments

We would like to thank for the security reports provided by:

the contributions to the source code by:

and the translation by:

And also to all the people contributing in the ejabberd chatroom, issue tracker...

Improvements in ejabberd Business Edition

Customers of the ejabberd Business Edition, in addition to all those bugfixes, also get the following changes:

Changes in SQL schema

This release modifies the push_customizations table in the SQL database schemas to support the new push notifications mute option (see below). This task is performed automatically by ejabberd by default.

However, if your configuration file has disabled update_sql_schema toplevel option, you must perform the SQL schema update manually yourself. Those instructions are valid for MySQL and PostgreSQL, both default and new schemas:

MySQL

ALTER TABLE push_customizations MODIFY COLUMN mute smallint;

PostgreSQL

ALTER TABLE push_customizations ALTER COLUMN mute TYPE smallint USING mute::int;

Push notifications

  • Add a push customization option to allow mentioned users (as described in XEP-0513) to be notified even in muted conversation.
  • Make proxy connections in applepushv3 always use http connect
  • Report push gate tokens in the results of the user_push_state command
  • Implement push errors reporting in the results of the user_push_state command.
  • Make mod_webpush reject tokens that don't have correct format.
  • Fix mod_webpush key parser.
  • Add ability to retrieve user nodes from push_gate.
  • Handle wildcard certificates now used by Google FCM service.

Commands

Add a new local_health_status command to return information about local node state.

Client certificate authentication

  • Add option require_xmpp_addr that forces client certs to have XmppAddr.
  • New recognize_email_addr option for mod_crl/mod_ocsp to add emailAddress from cert subject to be used beside xmppAddr for matching against provided user id.

p1db backend

  • Make mam_p1db serialization properly serialize MUC archives.
  • Fix JID encoding in roster_p1db serialization.
  • Fix decoding of fast_tokens in p1db backend

Clustering

Make join_cluster robust to race conditions on leave_cluster.

Docker

sqlite backend has been fixed in Docker image.

ejabberd 26.07 download & feedback

As usual, the release is tagged in the Git source code repository on GitHub.

The source package and installers are available in ejabberd Downloads page. To check the *.asc signature files, see How to verify ProcessOne downloads integrity.

For convenience, there are alternative download locations like the ejabberd DEB/RPM Packages Repository and the GitHub Release / Tags.

The ecs container image is available in docker.io/ejabberd/ecs and ghcr.io/processone/ecs. The alternative ejabberd container image is available in ghcr.io/processone/ejabberd.

If you consider that you've found a bug, please search or fill a bug report on GitHub Issues.

Written by Jérôme Sautret

Chief Technology Officer

Keep reading