Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 24 Apr 2015 20:40:37 +0000
From: Tilmann Haak <tilmann.haak@...g.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: CVE request: Perl XML::LibXML

Hi oss-sec,

I'd like to request a CVE number for an XEE vulnerability in Perl's XML::LibXML.

According to XML::LibXML's documentation it should be possible to
disable processing of external entities by using the "expand_entities" parameter.

Two example scripts are attached to this mail. The 
output of XEE-XML-LibXML-demo.pl should not contain external 
entities, but "expand_entities" is ignored. The output 
of XEE-XML-LibXML-demo2.pl is as expected (no external entities).

The behaviour depends on how the XML is loaded.
Using "$XML_DOC = XML::LibXML->load_xml" works as documented, using 
$parser = XML::LibXML->new and $XML_DOC = $parser->load_xml does not.

I've tested the issue on two platforms and was able to print out the 
system's "/etc/passwd" file.


Ubuntu 12.04.5 LTS
Perl version: v5.14.2
libxml2 version: 2.7.8
XML::LibXML version: 1.89

Mac OS X 10.9.5
Perl version: v5.16.2
libxml2 version: 2.9.0
XML::LibXML version: 2.0118


The vulnerability is fixed in version 2.0119.
I'm not sure which older versions are affected, however the vulnerability is present in version 1.89 and probably older versions, too.

The fix:
<https://bitbucket.org/shlomif/perl-xml-libxml/commits/5962fd067580767777e94640b129ae8930a68a30>

Changelog:
<http://cpansearch.perl.org/src/SHLOMIF/XML-LibXML-2.0119/Changes>

I'm not aware of other CVE requests.


Thanks in advance,
  Tilmann Haak

[ CONTENT OF TYPE application/octet-stream SKIPPED ]

[ CONTENT OF TYPE application/octet-stream SKIPPED ]

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ