CVSS: 7.8EPSS: 3%CPEs: 21EXPL: 2CVE-2014-2744
https://notcve.org/view.php?id=CVE-2014-2744
plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service (resource consumption) via compressed XML elements in an XMPP stream, aka an "xmppbomb" attack. plugins/mod_compression.lua en (1) Prosody anterior a 0.9.4 y (2) Lightwitch Metronome hasta 3.4 negocia compresión de cadena mientras una sesión no está autenticada, lo que permite a atacantes remotos causar una denegación de servicio (consumo de recursos) a través de elementos XML comprimidos en una cadena XMPP, también conocido como un ataque "xmppbomb". • http://blog.prosody.im/prosody-0-9-4-released http://code.lightwitch.org/metronome/rev/49f47277a411 http://hg.prosody.im/0.9/rev/b3b1c9da38fb http://openwall.com/lists/oss-security/2014/04/07/7 http://openwall.com/lists/oss-security/2014/04/09/1 http://secunia.com/advisories/57710 http://www.debian.org/security/2014/dsa-2895 http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 2%CPEs: 16EXPL: 0CVE-2011-2205
https://notcve.org/view.php?id=CVE-2011-2205
Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564. Prosody antes de v0.8.1 no detecta correctamente la recursividad durante la expansión de la entidad, lo que permite a atacantes remotos provocar una denegación de servicio (consumo de memoria y CPU) a través de un documento XML manipulado que contiene un gran número de referencias a entidades anidadas, un problema similar a CVE-2003-1564. • http://blog.prosody.im/prosody-0-8-1-released http://hg.prosody.im/0.8/rev/5305a665bdd4 http://hg.prosody.im/0.8/rev/ee6a18f10a8d http://prosody.im/doc/release/0.8.1 http://secunia.com/advisories/44852 http://www.openwall.com/lists/oss-security/2011/06/14/6 http://www.openwall.com/lists/oss-security/2011/06/15/5 http://www.securityfocus.com/bid/48125 https://exchange.xforce.ibmcloud.com/vulnerabilities/67884 • CWE-399: Resource Management Errors •