Log in Start free

Vulnerability · Published Aug 26, 2022 · Assigned by redhat

CVE-2022-0217

High 7.5

In plain English

A high-severity security flaw in prosody. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.5% (higher than 93% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High
Exploit odds (30 days)5.5%top 7.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20prosody0.11.12-r0ALPINE-CVE-2022-0217
Alpine:v3.21prosody0.11.12-r0ALPINE-CVE-2022-0217
Alpine:v3.22prosody0.11.12-r0ALPINE-CVE-2022-0217
Alpine:v3.23prosody0.11.12-r0ALPINE-CVE-2022-0217
Alpine:v3.24prosody0.11.12-r0ALPINE-CVE-2022-0217
Debian:12prosody0.11.12-1DEBIAN-CVE-2022-0217
Debian:13prosody0.11.12-1DEBIAN-CVE-2022-0217
Debian:14prosody0.11.12-1DEBIAN-CVE-2022-0217
Ubuntu:22.04:LTSprosodyno fix listedUBUNTU-CVE-2022-0217
Ubuntu:24.04:LTSprosodyno fix listedUBUNTU-CVE-2022-0217
Ubuntu:25.10prosodyno fix listedUBUNTU-CVE-2022-0217
Ubuntu:26.04:LTSprosodyno fix listedUBUNTU-CVE-2022-0217
Ubuntu:26.10prosodyno fix listedUBUNTU-CVE-2022-0217

Affected products (as reported)

VendorProductVersions
n/a prosody Fixed in prosody 0.11.12, Affects all versions with support for WebSockets.

Weakness: CWE-776

References