Description
ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5 allows remote authenticated users to cause a denial of service (daemon outage) by triggering large outgoing queues without reading messages.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.igniterealtime.openfire:openfire | < 3.5.0 | 3.5.0 | GHSA-x337-43mr-gg3h |
| Maven | org.igniterealtime.openfire:parent | < 3.5.0 | 3.5.0 | GHSA-x337-43mr-gg3h |
References
- ADV-2008-1188 vdb-entry
- openfire-connectionmanagerImpljava-dos(41744) vdb-entry
- http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.html
- GLSA-200804-26 vendor-advisory
- 28722 vdb-entry
- 29751 third-party-advisory
- http://www.igniterealtime.org/fisheye/changelog/svn-org?cs=10031
- [oss-security] 20080411 CVE request: openfire <3.5.0 Denial of Service mailing-list
- http://www.igniterealtime.org/issues/browse/JM-1289
- 29901 third-party-advisory