high8.7
CVE-2014-2829
Erlang Solutions MongooseIM vulnerable to denial of service (DoS) via crafted XMPP stream
Impact
Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| erlang | MongooseIM | <= 1.3.1 | 1.3.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Erlang-Solutions | Mongooseim | through 1.3.1 Versions 1.2.1, 1.2.2, 1.3.0, 1.3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/
- https://github.com/esl/MongooseIM/commit/586d96cc12ef218243a3466354b4d208b5472a6c
- https://github.com/advisories/GHSA-5v5w-44w6-q5hv
- https://nvd.nist.gov/vuln/detail/CVE-2014-2829
- http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas