Security update for prosody SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2022:0012-1 Final 1 1 2022-01-14T13:36:36Z current 2022-01-14T13:36:36Z 2022-01-14T13:36:36Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for prosody This update for prosody fixes the following issues: Update to 0.11.12: * CVE-2022-0217: util.xml: Do not allow doctypes, comments or processing instructions (bsc#1194596) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2022-12 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/T4AYNB4WRJM6UGUGE4MCR3AAVYPLM2PP/ E-Mail link for openSUSE-SU-2022:0012-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1194596 SUSE Bug 1194596 https://www.suse.com/security/cve/CVE-2022-0217/ SUSE CVE CVE-2022-0217 page SUSE Package Hub 15 SP3 openSUSE Leap 15.3 prosody-0.11.12-bp153.2.12.1 prosody-0.11.12-bp153.2.12.1 as a component of SUSE Package Hub 15 SP3 prosody-0.11.12-bp153.2.12.1 as a component of openSUSE Leap 15.3 It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611). CVE-2022-0217 SUSE Package Hub 15 SP3:prosody-0.11.12-bp153.2.12.1 openSUSE Leap 15.3:prosody-0.11.12-bp153.2.12.1 important 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/T4AYNB4WRJM6UGUGE4MCR3AAVYPLM2PP/ https://www.suse.com/security/cve/CVE-2022-0217.html CVE-2022-0217 https://bugzilla.suse.com/1194596 SUSE Bug 1194596