freebsd/ports
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security/vuxml: Document Prosody XMPP server advisory 2022-01-13

Browse Source 
PR:		261210
Reported by:	thomas@beingboiled.info
Security:	CVE-2022-0217
This commit is contained in:
Thomas Zander
2022-01-16 07:30:30 +01:00
parent d1120bc41c
commit 504d5f3edc
1 changed files with 31 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
security/vuxml/vuln-2022.xml
View File

@@ -1,3 +1,34 @@
<vuln vid="e3ec8b30-757b-11ec-922f-654747404482">
<topic>Prosody XMPP server advisory 2022-01-13</topic>
<affects>
<package>
<name>prosody</name>
<range><lt>0.11.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Prosody teaM reports:</p>
<blockquote cite="https://prosody.im/security/advisory_20220113/">
<p>It was discovered that an internal Prosody library to load XML based on
does not properly restrict the XML features allowed in parsed
XML data. Given suitable attacker input, this results in expansion of
recursive entity references from DTDs (CWE-776). In addition,
depending on the libexpat version used, it may also allow injections
using XML External Entity References (CWE-611).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-0217</cvename>
<url>https://prosody.im/security/advisory_20220113/</url>
</references>
<dates>
<discovery>2022-01-10</discovery>
<entry>2022-01-14</entry>
</dates>
</vuln>
<vuln vid="79b65dc5-749f-11ec-8be6-d4c9ef517024">
<topic>WordPress -- Multiple Vulnerabilities</topic>
<affects>