CVE-2022-0217 | BDVDB-2026-183295 Detail

prosody

Description#

It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).

Impact#

No impact statement in the source data.

Weaknesses#

CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion'), CWE-20 - Improper Input Validation.

References#

https://bugzilla.redhat.com/show_bug.cgi?id=2040639
https://prosody.im/security/advisory_20220113/
https://prosody.im/security/advisory_20220113/1.patch

Exploit#

No public exploit known

History#

Version 12022-08-26Record published in the CVE List.
Version 22024-08-02Most recent update recorded in the CVE List.