oss-sec mailing list archives
CVE request: XXE in perl Image::Info and XML::Twig
From: Doran Moppert <dmoppert () redhat com>
Date: Wed, 2 Nov 2016 15:37:58 +1030
Starting with this bug in XML::LibXML:
XML-LibXML: External entities are parsed by default
https://rt.cpan.org/Public/Bug/Display.html?id=118032 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838097 https://bugzilla.redhat.com/show_bug.cgi?id=1377996 .. which is an insecure default setting, probably not worthy of a CVE in itself. I did a brief audit of other CPAN modules in Fedora that may suffer from XXE, which uncovered these two:
XML-Twig: expand_external_ents fails to work as documented
https://rt.cpan.org/Public/Bug/Display.html?id=118097 https://bugzilla.redhat.com/show_bug.cgi?id=1379553 This option (which defaults to 0) is supposed to control XXE parsing documents with XML::Twig, but it has no effect and XXE always takes place. No fix is available yet, and my perl isn't up to proposing a sensible patch. XML::Twig 1.49 does feature an undocumented option 'NoXxe' which can be used to prevent entity expansion, but that option isn't present in 1.50 (current development branch) or in earlier versions (up to 1.44) I have checked.
Image-Info: XXE in SVG files
https://rt.cpan.org/Public/Bug/Display.html?id=118099 https://bugzilla.redhat.com/show_bug.cgi?id=1379556 This was promptly fixed in 1.38_50 / 1.39. Thanks, -- Doran Moppert Red Hat Product Security
Attachment:
_bin
Description:
Current thread:
- CVE request: XXE in perl Image::Info and XML::Twig Doran Moppert (Nov 01)
- Re: CVE request: XXE in perl Image::Info and XML::Twig cve-assign (Nov 04)