CVE-2014-2744

EUVD-2014-2771
plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service (resource consumption) via compressed XML elements in an XMPP stream, aka an "xmppbomb" attack.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:N/A:C
Base Score
CVSS 3.x
EPSS Score
Percentile: 84%
Affected Products (NVD)
VendorProductVersion
lightwitchmetronome
𝑥
≤ 3.4
prosodyprosody
𝑥
≤ 0.9.3
prosodyprosody
0.1.0
prosodyprosody
0.2.0
prosodyprosody
0.3.0
prosodyprosody
0.4.0
prosodyprosody
0.4.1
prosodyprosody
0.4.2
prosodyprosody
0.5.0
prosodyprosody
0.5.1
prosodyprosody
0.5.2
prosodyprosody
0.6.0
prosodyprosody
0.6.1
prosodyprosody
0.6.2
prosodyprosody
0.7.0
prosodyprosody
0.8.0
prosodyprosody
0.8.1
prosodyprosody
0.8.2
prosodyprosody
0.9.0
prosodyprosody
0.9.1
prosodyprosody
0.9.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
lua-expat
bookworm
1.5.1-3
fixed
bullseye
1.3.0-4
fixed
sid
1.5.2-1
fixed
squeeze
no-dsa
trixie
1.5.2-1
fixed
prosody
bookworm
0.12.3-1
fixed
bullseye
0.11.9-2+deb11u2
fixed
bullseye (security)
0.11.9-2+deb11u2
fixed
sid
0.12.4-2
fixed
squeeze
no-dsa
trixie
0.12.4-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
prosody
artful
not-affected
bionic
not-affected
cosmic
not-affected
disco
not-affected
lucid
ignored
precise
ignored
quantal
ignored
saucy
ignored
trusty
dne
utopic
not-affected
vivid
not-affected
wily
not-affected
xenial
not-affected
yakkety
not-affected
zesty
not-affected
Common Weakness Enumeration
References
http://blog.prosody.im/prosody-0-9-4-released/
http://code.lightwitch.org/metronome/rev/49f47277a411
http://hg.prosody.im/0.9/rev/b3b1c9da38fb
http://openwall.com/lists/oss-security/2014/04/07/7
http://openwall.com/lists/oss-security/2014/04/09/1
http://secunia.com/advisories/57710
http://www.debian.org/security/2014/dsa-2895
http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/
http://blog.prosody.im/prosody-0-9-4-released/
http://code.lightwitch.org/metronome/rev/49f47277a411
http://hg.prosody.im/0.9/rev/b3b1c9da38fb
http://openwall.com/lists/oss-security/2014/04/07/7
http://openwall.com/lists/oss-security/2014/04/09/1
http://secunia.com/advisories/57710
http://www.debian.org/security/2014/dsa-2895
http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/