QwikSec

Security Database

CVE

CWE

Training

CVE-2022-0217

Published: Aug 26, 2022

Modified: Aug 2, 2024

PUBLISHED

Description

It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).

Vendor	Product	Versions
n/a	prosody	affected `Fixed in prosody 0.11.12, Affects all versions with support for WebSockets.`

Weaknesses (CWE)

References

https://bugzilla.redhat.com/show_bug.cgi?id=2040639

x_refsource_MISC

https://prosody.im/security/advisory_20220113/

x_refsource_MISC

https://prosody.im/security/advisory_20220113/1.patch

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.