Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 600836 - app-admin/system-tools-backends: Package uses dev-perl/XML-Twig and makes no clear statement regarding handling of external entities (CVE-2016-9180)
Summary: app-admin/system-tools-backends: Package uses dev-perl/XML-Twig and makes no...
Status: RESOLVED WONTFIX
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [upstream?]
Keywords:
Depends on:
Blocks: 600818
  Show dependency tree
 
Reported: 2016-11-25 17:41 UTC by Thomas Deutschmann (RETIRED)
Modified: 2019-08-25 01:34 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Deutschmann (RETIRED) gentoo-dev 2016-11-25 17:41:41 UTC
It is suspected that this package is vulnerable to a security vulnerability due to expanding of malicious entities via dev-perl/XML-Twig. As such we ask maintainers with packages suspected to be vulnerable to verify if the package is (or have been) affected. 

Please see the information contained in the tracker bug 600818.


# grep -Fr 'Twig->new' /var/tmp/portage/app-admin/system-tools-backends-2.10.2/work/system-tools-backends-2.10.2
/var/tmp/portage/app-admin/system-tools-backends-2.10.2/work/system-tools-backends-2.10.2/Net-DBus/lib/Net/DBus/Binding/Introspector.pm:    my $twig = XML::Twig->new();


...so this is due to embedded dev-lang/Net-DBus, see bug 600824 and consider to unbundle.