CVE-2011-4320 Ejabberd DoS via malformed stanza
MediumCVSS 4.0
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The mod_pubsub module (mod_pubsub.erl) in ejabberd 2.1.8 and 3.0.0-alpha-3 allows remote authenticated users to cause a denial of service (infinite loop) via a stanza with a publish tag that lacks a node attribute.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hex ejabberd(Hex) | <= 2.1.8 | No fix listed |
| hex ejabberd(Hex) | >= 3.0.0-alpha-1, <= 3.0.0-alpha-3 | No fix listed |
| debian/ejabberd(Debian:12) | < 2.1.9-1 | 2.1.9-1 |
| debian/ejabberd(Debian:13) | < 2.1.9-1 | 2.1.9-1 |
| debian/ejabberd(Debian:14) | < 2.1.9-1 | 2.1.9-1 |
| process-one ejabberd | = 2.1.8 | No fix listed |
| process-one ejabberd | = 3.0.0-alpha3 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- support.process-one.net patch
- [oss-security] 20111119 CVE request: ejabberd before 2.1.9 mailing-list
- [oss-security] 20111119 Re: CVE request: ejabberd before 2.1.9 mailing-list
- www.process-one.net
- github.com patch
- github.com patch
- github.com
- Debian Security Tracker CVE-2011-4320 vendor-advisory
- 46915 third-party-advisory vendor-advisory
- 77302 vdb-entry