VDB
CVE-2014-2745
CVE-2014-2745
PUBLISHED
CVSS 7.800000190734863 HIGH
Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack, related to core/portmanager.lua and util/xmppstream.lua.
EPSS 3.14% · 87.8th percentile
Risk Scores
CVSS 2.0
7.800000190734863
EPSS Score
3.14%
87.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| prosody | prosody | 0.5.2, 0, 0.1.0 |
| n/a | n/a | n/a |
Timeline
- Apr 11, 2014 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Jul 13, 2022 EPSS Score
- Oct 28, 2022 EPSS Score
- Dec 20, 2022 EPSS Score
- Feb 11, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 5, 2023 EPSS Score
- May 28, 2023 EPSS Score
- Jul 20, 2023 EPSS Score
References
- http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/ url
- http://hg.prosody.im/0.9/rev/a97591d2e1ad url
- DSA-2895 vendor-advisory
- http://hg.prosody.im/0.9/rev/1107d66d2ab2 url
- http://blog.prosody.im/prosody-0-9-4-released/ url
- 57710 third-party-advisory
- [oss-security] 20140408 Re: (Openfire M-Link Metronome Prosody Tigase) Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression mailing-list
- [oss-security] 20140407 Re: Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression mailing-list
- https://nvd.nist.gov/vuln/detail/CVE-2014-2745 advisory
- http://blog.prosody.im/prosody-0-9-4-released url
- http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas url