ether/etherpad-lite — pull request #1609 by JohnMcLear (2013-03-13 13:38:58+00:00)
Title: SECURITY PATCH: Don't crash pad if bad author data is passed to the server

Type of attack: Persistent Denial-of-service.

Important: This security issue affects all old/legacy Etherpad instances also, they should update ASAP.

Outcome of attack: A user can send a single liner and access to a pad is completely broken for all users.

Steps to replicate: I wont provide steps to replicate here because all servers are currently vulnerable.

Thanks to Sebastian Nerz for spotting this.

Just on a related note our security audit from Mozilla is due to be published soon.