Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 519504 (CVE-2012-0877) - dev-python/pyxml: hash table collisions CPU usage DoS (oCERT-2011-003)
Summary: dev-python/pyxml: hash table collisions CPU usage DoS (oCERT-2011-003)
Status: RESOLVED WONTFIX
Alias: CVE-2012-0877
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B3 [upstream]
Keywords:
Depends on:
Blocks: hashDoS
  Show dependency tree
 
Reported: 2014-08-09 12:23 UTC by Agostino Sarubbo
Modified: 2016-03-19 08:23 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2014-08-09 12:23:01 UTC
From ${URL} :

However upstream PyXML will still be affected

Juraj Somorovsky reported that certain XML parsers/servers are affected by the
same, or similar, flaw as the hash table collisions CPU usage denial of
service.  Sending a specially crafted message to an XML service can result in
longer processing time, which could lead to a denial of service.  It is
reported that this attack on XML can be applied on different XML nodes (such as
entities, element attributes, namespaces, various elements in the XML security,
etc.).

PyXML is written in Python and makes significant use of arrays. It is unclear if fixing the Python 
array hash DoS bug (Bz 750555) will completely address this issue however at first glance it would 
appear to be the case. In other words no action should be neccesary from upstream to correct this.

Additionally our PyXML uses the system expat (from the spec file):



@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Ian Delaney (RETIRED) gentoo-dev 2014-08-13 02:04:44 UTC
<@maintainer(s): after the bump>

What bump?? The copy pasted paragraph tells us Bz 750555 has already been fixed no less than 2 years ago in Cpython. Then "In other words no action should be neccesary from upstream to correct this".  There is no traceable patch CVE patch.  If one is made feel free to tell us.
Comment 2 Aaron Bauman (RETIRED) gentoo-dev 2016-03-19 08:23:25 UTC
No traceable information for this vulnerability.  No other distro has anything either regarding the matter either.