CVE-2014-2746

Published: Apr 11, 2014

Modified: Aug 6, 2024

PUBLISHED

Description

net/IOService.java in Tigase before 5.2.1 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/

x_refsource_MISC

http://www.tigase.org/content/uncontrolled-resource-consumption-highly-compressed-xmpp-messages

x_refsource_CONFIRM

https://projects.tigase.org/issues/1780

x_refsource_CONFIRM

[oss-security] 20140408 Re: (Openfire M-Link Metronome Prosody Tigase) Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression

mailing-list

x_refsource_MLIST

https://projects.tigase.org/projects/tigase-server/repository/revisions/7f5af2f8c5b97bbf9def66fbb9dd47746a7ac292

x_refsource_CONFIRM

[oss-security] 20140407 Re: Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2014-2746

Description

Affected Products

References