Ignite Realtime Openfire vulnerable to XMPPbomb attack

Description

References

• nvd.nist.gov/vuln/detail/CVE-2014-2741 · ADVISORY
• igniterealtime/Openfire commit 3aec383 · WEB
• igniterealtime/Openfire · PACKAGE
• web.archive.org/web/20140407092132/http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas · WEB
• web.archive.org/web/20140705161237/http://fisheye.igniterealtime.org/changelog/openfiregit · WEB
• community.igniterealtime.org/thread/52317 · WEB
• openwall.com/lists/oss-security/2014/04/07/7 · WEB
• openwall.com/lists/oss-security/2014/04/09/1 · WEB
• kb.cert.org/vuls/id/495476 · WEB
• fisheye.igniterealtime.org/changelog/openfiregit

More vulnerabilities in org.igniterealtime.openfire:parent

• CVE-2019-20526MEDIUM 6.1Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter.
• CVE-2019-20525MEDIUM 6.1Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter.
• CVE-2019-20527MEDIUM 6.1Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter.
• CVE-2019-20366MEDIUM 6.1An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents.
• CVE-2019-18394CRITICAL 9.8A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send…