Date: Fri, 24 Apr 2015 20:40:37 +0000 From: Tilmann Haak <tilmann.haak@...g.com> To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com> Subject: CVE request: Perl XML::LibXML Hi oss-sec, I'd like to request a CVE number for an XEE vulnerability in Perl's XML::LibXML. According to XML::LibXML's documentation it should be possible to disable processing of external entities by using the "expand_entities" parameter. Two example scripts are attached to this mail. The output of XEE-XML-LibXML-demo.pl should not contain external entities, but "expand_entities" is ignored. The output of XEE-XML-LibXML-demo2.pl is as expected (no external entities). The behaviour depends on how the XML is loaded. Using "$XML_DOC = XML::LibXML->load_xml" works as documented, using $parser = XML::LibXML->new and $XML_DOC = $parser->load_xml does not. I've tested the issue on two platforms and was able to print out the system's "/etc/passwd" file. Ubuntu 12.04.5 LTS Perl version: v5.14.2 libxml2 version: 2.7.8 XML::LibXML version: 1.89 Mac OS X 10.9.5 Perl version: v5.16.2 libxml2 version: 2.9.0 XML::LibXML version: 2.0118 The vulnerability is fixed in version 2.0119. I'm not sure which older versions are affected, however the vulnerability is present in version 1.89 and probably older versions, too. The fix: <https://bitbucket.org/shlomif/perl-xml-libxml/commits/5962fd067580767777e94640b129ae8930a68a30> Changelog: <http://cpansearch.perl.org/src/SHLOMIF/XML-LibXML-2.0119/Changes> I'm not aware of other CVE requests. Thanks in advance, Tilmann Haak Download attachment "XEE-XML-LibXML-demo.pl" of type "application/octet-stream" (948 bytes) Download attachment "XEE-XML-LibXML-demo2.pl" of type "application/octet-stream" (930 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.