[Bug 1216112] New: perl-XML-LibXML: "expand_entities" option was not preserved under some circumstances
https://bugzilla.redhat.com/show_bug.cgi?id=1216112
Bug ID: 1216112 Summary: perl-XML-LibXML: "expand_entities" option was not preserved under some circumstances Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team@redhat.com Reporter: vkaigoro@redhat.com CC: jplesnik@redhat.com, mmaslano@redhat.com, perl-devel@lists.fedoraproject.org, perl-maint-list@redhat.com, ppisar@redhat.com, psabata@redhat.com
It was reported that perl-XML-LibXML did ignore "expand_entities" option in some circumstances, which could lead to sensitive information disclosure. Original report and CVE request (reprodcuers are also available): http://seclists.org/oss-sec/2015/q2/280
https://bugzilla.redhat.com/show_bug.cgi?id=1216112
Vasyl Kaigorodov vkaigoro@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1216113
https://bugzilla.redhat.com/show_bug.cgi?id=1216112
Vasyl Kaigorodov vkaigoro@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1216114
--- Comment #1 from Vasyl Kaigorodov vkaigoro@redhat.com ---
Created perl-XML-LibXML tracking bugs for this issue:
Affects: fedora-all [bug 1216114]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1216114 [Bug 1216114] perl-XML-LibXML: "expand_entities" option was not preserved under some circumstances [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1216112
Martin Prpic mprpic@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Alias| |CVE-2015-3451
https://bugzilla.redhat.com/show_bug.cgi?id=1216112
Martin Prpic mprpic@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|perl-XML-LibXML: |CVE-2015-3451 |"expand_entities" option |perl-XML-LibXML: |was not preserved under |"expand_entities" option |some circumstances |was not preserved under | |some circumstances
https://bugzilla.redhat.com/show_bug.cgi?id=1216112 Bug 1216112 depends on bug 1216114, which changed state.
Bug 1216114 Summary: perl-XML-LibXML: "expand_entities" option was not preserved under some circumstances [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1216114
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1216112
--- Comment #2 from Fedora Update System updates@fedoraproject.org --- perl-XML-LibXML-2.0119-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1216112
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20150423, |impact=low,public=20150423, |reported=20150423,source=re |reported=20150423,source=re |searcher,cvss2=2.6/AV:N/AC: |searcher,cvss2=2.6/AV:N/AC: |H/Au:N/C:P/I:N/A:N,fedora-a |H/Au:N/C:P/I:N/A:N,fedora-a |ll/perl-XML-LibXML=affected |ll/perl-XML-LibXML=affected |,rhel-5/perl-XML-LibXML=new |,rhel-5/perl-XML-LibXML=won |,rhel-6/perl-XML-LibXML=aff |tfix,rhel-6/perl-XML-LibXML |ected,rhel-7/perl-XML-LibXM |=wontfix,rhel-7/perl-XML-Li |L=affected |bXML=wontfix
--- Comment #3 from Kurt Seifried kseifried@redhat.com --- Mitigations:
This issue only affects programs using this program in forms such as:
$parser = XML::LibXML->new
or
$XML_DOC = $parser->load_xml
if you use the form:
$XML_DOC = XML::LibXML->load_xml
this vulnerability will not be exposed.
https://bugzilla.redhat.com/show_bug.cgi?id=1216112
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |WONTFIX Last Closed| |2015-08-06 20:01:21
--- Comment #4 from Kurt Seifried kseifried@redhat.com --- Statement:
This issue affects the versions of perl-XML-LibXML as shipped with Red Hat Enterprise Linux 5, 6 and 7. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
https://bugzilla.redhat.com/show_bug.cgi?id=1216112
Ján Rusnačko jrusnack@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |jrusnack@redhat.com Whiteboard|impact=low,public=20150423, |impact=low,public=20150423, |reported=20150423,source=re |reported=20150423,source=re |searcher,cvss2=2.6/AV:N/AC: |searcher,cvss2=2.6/AV:N/AC: |H/Au:N/C:P/I:N/A:N,fedora-a |H/Au:N/C:P/I:N/A:N,fedora-a |ll/perl-XML-LibXML=affected |ll/perl-XML-LibXML=affected |,rhel-5/perl-XML-LibXML=won |,rhel-5/perl-XML-LibXML=won |tfix,rhel-6/perl-XML-LibXML |tfix,rhel-6/perl-XML-LibXML |=wontfix,rhel-7/perl-XML-Li |=wontfix,rhel-7/perl-XML-Li |bXML=wontfix |bXML=wontfix,cwe=CWE-611
perl-devel@lists.fedoraproject.org
-
Red Hat Bugzilla