Description
The mod_pubsub module (mod_pubsub.erl) in ejabberd 2.1.8 and 3.0.0-alpha-3 allows remote authenticated users to cause a denial of service (infinite loop) via a stanza with a publish tag that lacks a node attribute.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ejabberd | 2.1.9-1 | — |
| Debian 13 | ejabberd | 2.1.9-1 | — |
| Debian 12 | ejabberd | 2.1.9-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Hex | ejabberd | < 2.1.9 | 2.1.9 | GHSA-2h3q-v47h-f4rc |
| Hex | ejabberd | >= 3.0.0-alpha-1, < 3.0.0-alpha-4 | 3.0.0-alpha-4 | GHSA-2h3q-v47h-f4rc |
References
- 46915 third-party-advisory
- [oss-security] 20111119 CVE request: ejabberd before 2.1.9 mailing-list
- 77302 vdb-entry
- https://support.process-one.net/browse/EJAB-1498
- [oss-security] 20111119 Re: CVE request: ejabberd before 2.1.9 mailing-list
- http://www.process-one.net/en/ejabberd/release_notes/release_note_ejabberd_2.1.9