Upstream information

CVE-2022-0217 at MITRE

Description

It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v3 Scores
  National Vulnerability Database
Base Score 7.5
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Impact None
Integrity Impact None
Availability Impact High
CVSSv3 Version 3.1
SUSE Bugzilla entry: 1194596 [RESOLVED / FIXED]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Package Hub 15 SP3
  • prosody >= 0.11.12-bp153.2.12.1
 Patchnames:
openSUSE-2022-12
openSUSE Leap 15.3
  • prosody >= 0.11.12-bp153.2.12.1
 Patchnames:
openSUSE-2022-12
openSUSE Tumbleweed
  • prosody >= 0.11.12-1.1
 Patchnames:
openSUSE-Tumbleweed-2024-11736

SUSE Timeline for this CVE

CVE page created: Wed Jan 12 12:30:22 2022
CVE page last modified: Tue Sep 3 19:23:26 2024