CVE-2014-2745

2014-04-1100:00:00

ubuntu.com

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.03 Low

EPSS

Percentile

90.7%

JSON

Prosody before 0.9.4 does not properly restrict the processing of
compressed XML elements, which allows remote attackers to cause a denial of
service (resource consumption) via a crafted XMPP stream, aka an “xmppbomb”
attack, related to core/portmanager.lua and util/xmppstream.lua.