https://bugzilla.redhat.com/show_bug.cgi?id=1377996
Bug ID: 1377996 Summary: perl-libxml-perl: Expanding external entities by default Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: amaris@redhat.com CC: jplesnik@redhat.com, perl-devel@lists.fedoraproject.org, perl-maint-list@redhat.com, ppisar@redhat.com, psabata@redhat.com
It was found that XML::LibXML is vulnerable to XXE attack as it has enabled external entity loading by default.
Bug report:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838097
https://bugzilla.redhat.com/show_bug.cgi?id=1377996
Adam Mariš amaris@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1377997
--- Comment #1 from Adam Mariš amaris@redhat.com ---
Created perl-libxml-perl tracking bugs for this issue:
Affects: fedora-all [bug 1377997]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1377997 [Bug 1377997] perl-libxml-perl: Expanding external entities by default [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1377996
Adam Mariš amaris@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1377998
https://bugzilla.redhat.com/show_bug.cgi?id=1377996
Petr Pisar ppisar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|perl-libxml-perl: Expanding |perl-XML-LibXML: Expanding |external entities by |external entities by |default |default
--- Comment #2 from Petr Pisar ppisar@redhat.com --- (In reply to Adam Mariš from comment #1)
Created perl-libxml-perl tracking bugs for this issue:
Affects: fedora-all [bug 1377997]
Thant's wrong component. The Debian bug is about http://search.cpan.org/~shlomif/XML-LibXML-2.0116/ that is packaged as libxml-libxml-perl in Debian and as perl-XML-LibXML in Fedora.
https://bugzilla.redhat.com/show_bug.cgi?id=1377996
Petr Pisar ppisar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- External Bug ID| |CPAN 118032
--- Comment #3 from Petr Pisar ppisar@redhat.com --- I forwarded the request for changing default behavior to the LibXML-XML upstream https://rt.cpan.org/Public/Bug/Display.html?id=118032.
https://bugzilla.redhat.com/show_bug.cgi?id=1377996
--- Comment #4 from Petr Pisar ppisar@redhat.com --- Created attachment 1203692 --> https://bugzilla.redhat.com/attachment.cgi?id=1203692&action=edit Reproducer
This reveals /etc/passwd content. Fixed Perl should not allow that if loading (external) entities was not requested explicitly.
https://bugzilla.redhat.com/show_bug.cgi?id=1377996
Doran Moppert dmoppert@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=moderate,public=2016 |60917,reported=20160920,sou |0917,reported=20160920,sour |rce=debian,cvss2=6.8/AV:N/A |ce=debian,cvss2=6.8/AV:N/AC |C:M/Au:N/C:P/I:P/A:P,cvss3= |:M/Au:N/C:P/I:P/A:P,cvss3=7 |7.0/CVSS:3.0/AV:N/AC:H/PR:N |.0/CVSS:3.0/AV:N/AC:H/PR:N/ |/UI:N/S:U/C:H/I:L/A:L,cwe=C |UI:N/S:U/C:H/I:L/A:L,cwe=CW |WE-611,rhel-5/perl-libxml-p |E-611,rhel-5/perl-libxml-pe |erl=new,rhel-6/perl-libxml- |rl=new,rhel-6/perl-libxml-p |perl=new,rhel-7/perl-libxml |erl=new,rhel-7/perl-libxml- |-perl=new,fedora-all/perl-l |perl=new,fedora-all/perl-li |ibxml-perl=affected |bxml-perl=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1377996
Doran Moppert dmoppert@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |0917,reported=20160920,sour |0917,reported=20160920,sour |ce=debian,cvss2=6.8/AV:N/AC |ce=debian,cvss2=6.8/AV:N/AC |:M/Au:N/C:P/I:P/A:P,cvss3=7 |:M/Au:N/C:P/I:P/A:P,cvss3=7 |.0/CVSS:3.0/AV:N/AC:H/PR:N/ |.0/CVSS:3.0/AV:N/AC:H/PR:N/ |UI:N/S:U/C:H/I:L/A:L,cwe=CW |UI:N/S:U/C:H/I:L/A:L,cwe=CW |E-611,rhel-5/perl-libxml-pe |E-611,rhel-5/perl-XML-LibXM |rl=new,rhel-6/perl-libxml-p |L=new,rhel-6/perl-XML-LibXM |erl=new,rhel-7/perl-libxml- |L=new,rhel-7/perl-XML-LibXM |perl=new,fedora-all/perl-li |L=new,fedora-all/perl-XML-L |bxml-perl=affected |ibXML=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1377996
Doran Moppert dmoppert@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |0917,reported=20160920,sour |0917,reported=20160920,sour |ce=debian,cvss2=6.8/AV:N/AC |ce=debian,cvss2=6.8/AV:N/AC |:M/Au:N/C:P/I:P/A:P,cvss3=7 |:M/Au:N/C:P/I:P/A:P,cvss3=7 |.0/CVSS:3.0/AV:N/AC:H/PR:N/ |.0/CVSS:3.0/AV:N/AC:H/PR:N/ |UI:N/S:U/C:H/I:L/A:L,cwe=CW |UI:N/S:U/C:H/I:L/A:L,cwe=CW |E-611,rhel-5/perl-XML-LibXM |E-611,rhel-5/perl-XML-LibXM |L=new,rhel-6/perl-XML-LibXM |L=affected,rhel-6/perl-XML- |L=new,rhel-7/perl-XML-LibXM |LibXML=affected,rhel-7/perl |L=new,fedora-all/perl-XML-L |-XML-LibXML=affected,fedora |ibXML=affected |-all/perl-XML-LibXML=affect | |ed
https://bugzilla.redhat.com/show_bug.cgi?id=1377996
--- Comment #5 from Doran Moppert dmoppert@redhat.com --- Mitigation:
https://bugzilla.redhat.com/show_bug.cgi?id=1377996
Petr Pisar ppisar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Attachment|0 |1 #1203692 is| | obsolete| |
--- Comment #6 from Petr Pisar ppisar@redhat.com --- Created attachment 1206227 --> https://bugzilla.redhat.com/attachment.cgi?id=1206227&action=edit Parametrized reproduder
Yes, but that disables expanding internal entities too. This is unacceptable. I think XML::LibXML or libxml2 is missing a knob that affects external entities only.
Attached script accepts an optional argument and pass it as expand_entities option value if exists. If you execute it with "0", it also disabled expanding the internal entity. And I think this is wrong.
https://bugzilla.redhat.com/show_bug.cgi?id=1377996
--- Comment #7 from Petr Pisar ppisar@redhat.com --- Created attachment 1206255 --> https://bugzilla.redhat.com/attachment.cgi?id=1206255&action=edit Disable entitiy expansion
Proposed fix that disables entity expansion by default. It affects both external and internal entities.
It still allows to load external DTD.
https://bugzilla.redhat.com/show_bug.cgi?id=1377996
Petr Pisar ppisar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Attachment|0 |1 #1206227 is| | obsolete| |
--- Comment #9 from Petr Pisar ppisar@redhat.com --- Created attachment 1232169 --> https://bugzilla.redhat.com/attachment.cgi?id=1232169&action=edit Parametrized reproduder
I attached wrong file. This is the correct parametrized reproducer that exhibits various types of entities.
https://bugzilla.redhat.com/show_bug.cgi?id=1377996
Doran Moppert dmoppert@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks|1377998 |1395614
https://bugzilla.redhat.com/show_bug.cgi?id=1377996
Doran Moppert dmoppert@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |WONTFIX Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |0917,reported=20160920,sour |0917,reported=20160920,sour |ce=debian,cvss2=6.8/AV:N/AC |ce=debian,cvss2=3.3/AV:L/AC |:M/Au:N/C:P/I:P/A:P,cvss3=7 |:M/Au:N/C:P/I:N/A:P,cvss3=5 |.0/CVSS:3.0/AV:N/AC:H/PR:N/ |.7/CVSS:3.0/AV:L/AC:H/PR:N/ |UI:N/S:U/C:H/I:L/A:L,cwe=CW |UI:N/S:U/C:H/I:N/A:L,cwe=CW |E-611,rhel-5/perl-XML-LibXM |E-611,rhel-5/perl-XML-LibXM |L=affected,rhel-6/perl-XML- |L=wontfix,rhel-6/perl-XML-L |LibXML=affected,rhel-7/perl |ibXML=wontfix,rhel-7/perl-X |-XML-LibXML=affected,fedora |ML-LibXML=wontfix,fedora-al |-all/perl-XML-LibXML=affect |l/perl-XML-LibXML=affected |ed | Last Closed| |2018-01-08 21:26:32
perl-devel@lists.fedoraproject.org