CVSS: 7.8EPSS: 3%CPEs: 20EXPL: 0CVE-2014-2745
https://notcve.org/view.php?id=CVE-2014-2745
Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack, related to core/portmanager.lua and util/xmppstream.lua. Prosody anterior a 0.9.4 no restringe debidamente el procesamiento de elementos XML comprimidos, lo que permite a atacantes remotos causar una denegación de servicio (consumo de recursos) a través de una cadena XMPP manipulada, también conocido como una ataque "xmppbomb", relacionado con core/portmanager.lua y util/xmppstream.lua. • http://blog.prosody.im/prosody-0-9-4-released http://hg.prosody.im/0.9/rev/1107d66d2ab2 http://hg.prosody.im/0.9/rev/a97591d2e1ad http://openwall.com/lists/oss-security/2014/04/07/7 http://openwall.com/lists/oss-security/2014/04/09/1 http://secunia.com/advisories/57710 http://www.debian.org/security/2014/dsa-2895 http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 2%CPEs: 16EXPL: 0CVE-2011-2205
https://notcve.org/view.php?id=CVE-2011-2205
Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564. Prosody antes de v0.8.1 no detecta correctamente la recursividad durante la expansión de la entidad, lo que permite a atacantes remotos provocar una denegación de servicio (consumo de memoria y CPU) a través de un documento XML manipulado que contiene un gran número de referencias a entidades anidadas, un problema similar a CVE-2003-1564. • http://blog.prosody.im/prosody-0-8-1-released http://hg.prosody.im/0.8/rev/5305a665bdd4 http://hg.prosody.im/0.8/rev/ee6a18f10a8d http://prosody.im/doc/release/0.8.1 http://secunia.com/advisories/44852 http://www.openwall.com/lists/oss-security/2011/06/14/6 http://www.openwall.com/lists/oss-security/2011/06/15/5 http://www.securityfocus.com/bid/48125 https://exchange.xforce.ibmcloud.com/vulnerabilities/67884 • CWE-399: Resource Management Errors •