519502 – (CVE-2012-0881) dev-java/xerces: hash table collisions CPU usage DoS (CVE-2012-0881)

Bug 519502 (CVE-2012-0881) - dev-java/xerces: hash table collisions CPU usage DoS (CVE-2012-0881)

Summary: dev-java/xerces: hash table collisions CPU usage DoS (CVE-2012-0881)

Status:	RESOLVED FIXED

Alias:	CVE-2012-0881

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:	https://bugzilla.redhat.com/show_bug....
Whiteboard:	B3 [noglsa]
Keywords:

Depends on:	268619
Blocks:	hashDoS
	Show dependency tree

Reported:	2014-08-09 12:21 UTC by Agostino Sarubbo
Modified:	2015-12-23 23:46 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Agostino Sarubbo gentoo-dev

2014-08-09 12:21:56 UTC

From ${URL} :

Juraj Somorovsky reported that certain XML parsers/servers are affected by the
same, or similar, flaw as the hash table collisions CPU usage denial of
service.  Sending a specially crafted message to an XML service can result in
longer processing time, which could lead to a denial of service.  It is
reported that this attack on XML can be applied on different XML nodes (such as
entities, element attributes, namespaces, various elements in the XML security,
etc.).

xerces-j2 is written in Java and makes significant use of arrays.


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

Comment 1 Patrice Clement gentoo-dev

2015-11-01 18:38:50 UTC

This CVE is not really explanatory: which version is affected? what is the fix? We ship xerces-1.3 and the very latest version available at http://xerces.apache.org/mirrors.cgi, that is 2.11.0. I guess it might affect older versions. The only package relying on xerces-1.3 is castor and it's been marked for removal. I will remove it after castor is removed. Please note that RH closed the bug as WONTFIX: https://bugzilla.redhat.com/show_bug.cgi?id=787104.

Comment 2 Patrice Clement gentoo-dev

2015-12-02 16:27:13 UTC

* commit 95e1895
| Author: Patrice Clement <monsieurp@gentoo.org>
| Date:   Wed Dec 2 16:19:49 2015 +0000
|
|     dev-java/xerces: Remove vulnerable version. Fixes security bug 519502.
|
|     Package-Manager: portage-2.2.20.1
|     Signed-off-by: Patrice Clement <monsieurp@gentoo.org>
|
|  delete mode 100644 dev-java/xerces/files/xerces-1.3.1-build.xml
|  delete mode 100644 dev-java/xerces/files/xerces-2.3.0-gentoo.patch
|  delete mode 100644 dev-java/xerces/files/xerces-2.9.0-gentoo.patch
|  delete mode 100644 dev-java/xerces/files/xerces-2.9.0-no_dom3.patch
|  delete mode 100644 dev-java/xerces/files/xerces-2.9.1-gentoo.patch
|  delete mode 100644 dev-java/xerces/files/xerces-2.9.1-no_dom3.patch
|  delete mode 100644 dev-java/xerces/xerces-1.3.1-r2.ebuild

Security team,

Please vote.

Comment 3 Yury German Gentoo Infrastructure

2015-12-02 16:57:30 UTC

Please review https://www.gentoo.org/support/security/vulnerability-treatment-policy.html for the future. Vote is not one of the whiteboards :)

Security Please Vote.
GLSA Vote: No

Comment 4 Yury German Gentoo Infrastructure

2015-12-23 23:46:23 UTC

Thank you all. Closing as noglsa.