CVE-2022-0217

NameCVE-2022-0217
DescriptionIt was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDSA-5047-1
Debian Bugs1003696

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
prosody (PTS)buster, buster (security)0.11.2-1+deb10u4fixed
bullseye (security), bullseye0.11.9-2+deb11u2fixed
bookworm, sid0.12.1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
prosodysourcebuster0.11.2-1+deb10u3DSA-5047-1
prosodysourcebullseye0.11.9-2+deb11u1DSA-5047-1
prosodysource(unstable)0.11.12-11003696

Notes

[stretch] - prosody <ignored> (websocket module introduced in 0.10.0; internal XML API only used on trusted data)
https://prosody.im/security/advisory_20220113/
Patch: https://prosody.im/security/advisory_20220113/1.patch
https://hg.prosody.im/0.11/raw-rev/783056b4e448
https://www.openwall.com/lists/oss-security/2022/01/13/3
Regression: https://issues.prosody.im/1711
Regression fix: https://hg.prosody.im/trunk/rev/e5e0ab93d7f4

Search for package or bug name: Reporting problems