CVE-2011-2205 Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document cont...
MediumCVSS 5.0
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/prosody(Debian:12) | < 0.7.0-1 | 0.7.0-1 |
| debian/prosody(Debian:13) | < 0.7.0-1 | 0.7.0-1 |
| debian/prosody(Debian:14) | < 0.7.0-1 | 0.7.0-1 |
| prosody | <= 0.8.0 | No fix listed |
| prosody | = 0.1.0 | No fix listed |
| prosody | = 0.2.0 | No fix listed |
| prosody | = 0.3.0 | No fix listed |
| prosody | = 0.4.0 | No fix listed |
| prosody | = 0.4.1 | No fix listed |
| prosody | = 0.4.2 | No fix listed |
| prosody | = 0.5.0 | No fix listed |
| prosody | = 0.5.1 | No fix listed |
| prosody | = 0.5.2 | No fix listed |
| prosody | = 0.6 | No fix listed |
| prosody | = 0.6.0 | No fix listed |
| prosody | = 0.6.1 | No fix listed |
| prosody | = 0.7 | No fix listed |
| prosody | = 0.7.0 | No fix listed |
| prosody | = 0.8 | No fix listed |
References
- Debian Security Tracker CVE-2011-2205 vendor-advisory
- blog.prosody.im patch
- hg.prosody.im patch
- hg.prosody.im patch
- prosody.im patch
- 44852 third-party-advisory vendor-advisory
- [oss-security] 20110614 CVE Request: prosody DoS, djabberd external entity injection mailing-list
- [oss-security] 20110615 Re: CVE Request: prosody DoS, djabberd external entity injection mailing-list
- 48125 vdb-entry
- prosody-xml-dos(67884) vdb-entry
- bugs.debian.org issue-tracking