oss-sec mailing list archives
CVE request: Perl XML::LibXML
From: Tilmann Haak <tilmann.haak () xing com>
Date: Fri, 24 Apr 2015 20:40:37 +0000
Hi oss-sec, I'd like to request a CVE number for an XEE vulnerability in Perl's XML::LibXML. According to XML::LibXML's documentation it should be possible to disable processing of external entities by using the "expand_entities" parameter. Two example scripts are attached to this mail. The output of XEE-XML-LibXML-demo.pl should not contain external entities, but "expand_entities" is ignored. The output of XEE-XML-LibXML-demo2.pl is as expected (no external entities). The behaviour depends on how the XML is loaded. Using "$XML_DOC = XML::LibXML->load_xml" works as documented, using $parser = XML::LibXML->new and $XML_DOC = $parser->load_xml does not. I've tested the issue on two platforms and was able to print out the system's "/etc/passwd" file. Ubuntu 12.04.5 LTS Perl version: v5.14.2 libxml2 version: 2.7.8 XML::LibXML version: 1.89 Mac OS X 10.9.5 Perl version: v5.16.2 libxml2 version: 2.9.0 XML::LibXML version: 2.0118 The vulnerability is fixed in version 2.0119. I'm not sure which older versions are affected, however the vulnerability is present in version 1.89 and probably older versions, too. The fix: <https://bitbucket.org/shlomif/perl-xml-libxml/commits/5962fd067580767777e94640b129ae8930a68a30> Changelog: <http://cpansearch.perl.org/src/SHLOMIF/XML-LibXML-2.0119/Changes> I'm not aware of other CVE requests. Thanks in advance, Tilmann Haak
Attachment:
XEE-XML-LibXML-demo.pl
Description: XEE-XML-LibXML-demo.pl
Attachment:
XEE-XML-LibXML-demo2.pl
Description: XEE-XML-LibXML-demo2.pl
Current thread:
- CVE request: Perl XML::LibXML Tilmann Haak (Apr 24)
- Re: CVE request: Perl XML::LibXML cve-assign (Apr 29)