[MAVEN:GHSA-X337-43MR-GG3H] Ignite Realtime Openfire allows remote authenticated users to cause a denial of service

Severity Moderate

Affected Packages 2

Fixed Packages 2

CVEs 1

ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5 allows remote authenticated users to cause a denial of service (daemon outage) by triggering large outgoing queues without reading messages.

Package	Affected Version
pkg:maven/org.igniterealtime.openfire/parent	< 3.5.0
pkg:maven/org.igniterealtime.openfire/openfire	< 3.5.0

Package	Fixed Version
pkg:maven/org.igniterealtime.openfire/parent	= 3.5.0
pkg:maven/org.igniterealtime.openfire/openfire	= 3.5.0

ID

MAVEN:GHSA-X337-43MR-GG3H

Severity

moderate

URL

https://github.com/advisories/GHSA-x337-43mr-gg3h

Published

2022-05-01T23:42:48
(2 years ago)

Modified

2024-02-16T17:36:29
(7 months ago)

Rights

Maven Security Team

Other Advisories

Source	# ID	Name	URL
			https://nvd.nist.gov/vuln/detail/CVE-2008-1728
			https://exchange.xforce.ibmcloud.com/vulnerabilities/41744
			http://security.gentoo.org/glsa/glsa-200804-26.xml
			http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.html
			http://www.igniterealtime.org/fisheye/changelog/svn-org?cs=10031
			http://www.igniterealtime.org/issues/browse/JM-1289
			http://www.openwall.com/lists/oss-security/2008/04/10/7
			https://github.com/igniterealtime/Openfire/commit/c9cd1e521673ef0cccb8795b78d3cbaefb8a576a
			https://web.archive.org/web/20080517012408/http://www.securityfocus.com/bid/28722
			https://web.archive.org/web/20080628231441/http://secunia.com/advisories/29751
			https://web.archive.org/web/20080724051528/http://secunia.com/advisories/29901
			https://github.com/advisories/GHSA-x337-43mr-gg3h

Type	Package URL	Namespace	Name / Product	Version
Affected	pkg:maven/org.igniterealtime.openfire/parent	org.igniterealtime.openfire	parent	< 3.5.0
Fixed	pkg:maven/org.igniterealtime.openfire/parent	org.igniterealtime.openfire	parent	= 3.5.0
Affected	pkg:maven/org.igniterealtime.openfire/openfire	org.igniterealtime.openfire	openfire	< 3.5.0
Fixed	pkg:maven/org.igniterealtime.openfire/openfire	org.igniterealtime.openfire	openfire	= 3.5.0

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date