CVE-2014-2829 Erlang Solutions MongooseIM vulnerable to denial of service (DoS) via crafted XMPP stream
HighCVSS 7.8
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| erlang-solutions mongooseim | <= 1.3.1 | No fix listed |
| erlang-solutions mongooseim | = 1.2.1 | No fix listed |
| erlang-solutions mongooseim | = 1.2.2 | No fix listed |
| erlang-solutions mongooseim | = 1.3.0 | No fix listed |
| erlang-solutions mongooseim | = 1.3.1 | No fix listed |
| hex mongooseim(Hex) | <= 1.3.1 | No fix listed |
References
- xmpp.org
- github.com exploit patch
- nvd.nist.gov third-party-advisory
- github.com