Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 600824 - dev-perl/Net-DBus: Package uses dev-perl/XML-Twig and makes no clear statement regarding handling of external entities (CVE-2016-9180)
Summary: dev-perl/Net-DBus: Package uses dev-perl/XML-Twig and makes no clear statemen...
Status: RESOLVED WONTFIX
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://rt.cpan.org/Ticket/Display.ht...
Whiteboard: B3 [upstream?]
Keywords:
Depends on:
Blocks: 600818
  Show dependency tree
 
Reported: 2016-11-25 17:24 UTC by Thomas Deutschmann (RETIRED)
Modified: 2019-08-25 01:34 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Deutschmann (RETIRED) gentoo-dev 2016-11-25 17:24:30 UTC 
It is suspected that this package is vulnerable to a security vulnerability due to expanding of malicious entities via dev-perl/XML-Twig. As such we ask maintainers with packages suspected to be vulnerable to verify if the package is (or have been) affected. 

Please see the information contained in the tracker bug 600818.


# grep -Fr 'Twig->new' /var/tmp/portage/dev-perl/Net-DBus-1.1.0/work/Net-DBus-1.1.0
/var/tmp/portage/dev-perl/Net-DBus-1.1.0/work/Net-DBus-1.1.0/lib/Net/DBus/Binding/Introspector.pm:    my $twig = XML::Twig->new();
Comment 1 D'juan McDonald (domhnall) 2017-09-20 08:35:30 UTC 
Tested on 9/9/2017 ---

developer / # grep -Fr 'use XML' Net-DBus-1.1.0

Net-DBus-1.1.0/lib/Net/DBus/Binding/Introspector.pm:use XML::Twig;
Net-DBus-1.1.0/lib/Net/DBus/Binding/Introspector.pm:    my $twig = XML::Twig->new();
Net-DBus-1.1.0/MYMETA.json:            "XML::Twig" : "0"
Net-DBus-1.1.0/Changes: - Replace use of XML::Grove with XML::Twig when parsing the 
Net-DBus-1.1.0/Makefile.PL:		  'XML::Twig' => 0,

Daj Uan (jmbailey)
Gentoo Security Padawan