Detections
Analytics

Alpine: multiple prosody packages: security update to 0.11.12-r0

high Tenable Cloud Security Plugin ID 406588

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - It was discovered that an internal Prosody library to load XML based on libexpat does not properly
 restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in
 expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat
 version used, it may also allow injections using XML External Entity References (CWE-611). (CVE-2022-0217)

See Also

https://security.alpinelinux.org/vuln/CVE-2022-0217

Plugin Details

Severity: High

ID: 406588

Version: Revision 1.29

Type: Local

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2022-0217

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 1/14/2022

Reference Information

CVE: CVE-2022-0217