CVE-2011-2205: Medium severity prosody vulnerability
Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2205?
CVE-2011-2205 has a medium severity due to its potential for denial of service through excessive memory and CPU consumption.
How do I fix CVE-2011-2205?
To fix CVE-2011-2205, you should upgrade Prosody to version 0.8.1 or later.
What versions of Prosody are affected by CVE-2011-2205?
All versions of Prosody prior to 0.8.1 are affected by CVE-2011-2205.
What type of attack does CVE-2011-2205 allow?
CVE-2011-2205 allows remote attackers to execute a denial of service attack by sending a crafted XML document.
Is CVE-2011-2205 related to any other vulnerabilities?
Yes, CVE-2011-2205 is similar to CVE-2003-1564, which also involves issues with entity expansion.