Description
Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | prosody | 0.7.0-1 | — |
| Debian 13 | prosody | 0.7.0-1 | — |
| Debian 12 | prosody | 0.7.0-1 | — |
References
- http://blog.prosody.im/prosody-0-8-1-released/
- http://hg.prosody.im/0.8/rev/5305a665bdd4
- prosody-xml-dos(67884) vdb-entry
- http://hg.prosody.im/0.8/rev/ee6a18f10a8d
- [oss-security] 20110615 Re: CVE Request: prosody DoS, djabberd external entity injection mailing-list
- 44852 third-party-advisory
- http://prosody.im/doc/release/0.8.1
- [oss-security] 20110614 CVE Request: prosody DoS, djabberd external entity injection mailing-list
- 48125 vdb-entry