CVE Request: jabberd remote information disclosure

[Joe Malcolm <jmalcolm () uraeus com>]

Was a CVE assigned for this?

Joe

Thijs Alkemade writes:
> Hello,
>
> A buffer overflow was found in the XMPP server jabberd2 when normalizing
> strings that can lead to remote information disclosure [1]. When parsing a
> JID, jabberd2 version 2.3.2 and below truncate the data but do not verify
> whether the result is valid UTF8 before passing it to libidn. If the data ends
> with an unterminated multi-byte UTF8 sequence then libidn may copy data past
> the buffer into the result. This can be exploited by remote clients or remote
> servers.
>
> Could you please assign a CVE for this issue?
>
> [1] = https://github.com/jabberd2/jabberd2/issues/85
>
> Best regards,
> Thijs Alkemade