oss-security - CVE request: Perl XML::LibXML

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <8BB9CA6B6B0D854E91889283C9B54C75DAF38EAB@xing-exchsvr04.xing.hh>
Date: Fri, 24 Apr 2015 20:40:37 +0000
From: Tilmann Haak <tilmann.haak@...g.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: CVE request: Perl XML::LibXML

Hi oss-sec,

I'd like to request a CVE number for an XEE vulnerability in Perl's XML::LibXML.

According to XML::LibXML's documentation it should be possible to
disable processing of external entities by using the "expand_entities" parameter.

Two example scripts are attached to this mail. The 
output of XEE-XML-LibXML-demo.pl should not contain external 
entities, but "expand_entities" is ignored. The output 
of XEE-XML-LibXML-demo2.pl is as expected (no external entities).

The behaviour depends on how the XML is loaded.
Using "$XML_DOC = XML::LibXML->load_xml" works as documented, using 
$parser = XML::LibXML->new and $XML_DOC = $parser->load_xml does not.

I've tested the issue on two platforms and was able to print out the 
system's "/etc/passwd" file.

Ubuntu 12.04.5 LTS
Perl version: v5.14.2
libxml2 version: 2.7.8
XML::LibXML version: 1.89

Mac OS X 10.9.5
Perl version: v5.16.2
libxml2 version: 2.9.0
XML::LibXML version: 2.0118

The vulnerability is fixed in version 2.0119.
I'm not sure which older versions are affected, however the vulnerability is present in version 1.89 and probably older versions, too.

The fix:
<https://bitbucket.org/shlomif/perl-xml-libxml/commits/5962fd067580767777e94640b129ae8930a68a30>

Changelog:
<http://cpansearch.perl.org/src/SHLOMIF/XML-LibXML-2.0119/Changes>

I'm not aware of other CVE requests.

Thanks in advance,
  Tilmann Haak

Download attachment "XEE-XML-LibXML-demo.pl" of type "application/octet-stream" (948 bytes)

Download attachment "XEE-XML-LibXML-demo2.pl" of type "application/octet-stream" (930 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.