CVE-2014-2829 Erlang Solutions MongooseIM vulnerable to denial of service (DoS) via crafted XMPP stream
Remote attackers can cause denial of service in MongooseIM via crafted XMPP streams exploiting compressed XML processing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-2829?
CVE-2014-2829 is a high-severity denial of service vulnerability in n/a, published on 11 Apr 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.
Weakness: CWE-264
Which versions are affected by CVE-2014-2829?
2 open source packages ship an affected version, including MongooseIM. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
MongooseIM Hex | All versions | 1.3.2 |
MongooseIM Hex | All versions | 1.3.2 |
Products include Erlang-Solutions Mongooseim.
How do I fix CVE-2014-2829?
Upgrade MongooseIM to 1.3.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2014-2829 being exploited?
There is no known exploitation of CVE-2014-2829 in the wild and no public exploit code.
Sources
Also known as GHSA-5v5w-44w6-q5hv.