CVE-2022-0217

2022-08-2618:15:00

Debian Security Bug Tracker

security-tracker.debian.org

0.001 Low

EPSS

Percentile

45.3%

JSON

It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).

OSVersionArchitecturePackageVersionFilename
Debian12allprosody< 0.11.12-1prosody_0.11.12-1_all.deb
Debian11allprosody< 0.11.9-2+deb11u1prosody_0.11.9-2+deb11u1_all.deb
Debian10allprosody< 0.11.2-1+deb10u3prosody_0.11.2-1+deb10u3_all.deb
Debian999allprosody< 0.11.12-1prosody_0.11.12-1_all.deb
Debian13allprosody< 0.11.12-1prosody_0.11.12-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	prosody	< 0.11.12-1	prosody_0.11.12-1_all.deb
Debian	11	all	prosody	< 0.11.9-2+deb11u1	prosody_0.11.9-2+deb11u1_all.deb
Debian	10	all	prosody	< 0.11.2-1+deb10u3	prosody_0.11.2-1+deb10u3_all.deb
Debian	999	all	prosody	< 0.11.12-1	prosody_0.11.12-1_all.deb
Debian	13	all	prosody	< 0.11.12-1	prosody_0.11.12-1_all.deb

0.001 Low

EPSS

Percentile

45.3%

JSON

Related for DEBIANCVE:CVE-2022-0217