From ${URL} : Description Some vulnerabilities have been reported in Zend Framework, which can be exploited by malicious people to bypass certain security restrictions and disclose certain sensitive information or cause a DoS (Denial of Service). 1) Some errors when parsing XML entities can be exploited to e.g. disclose contents of certain local files or consume excessive server resources via specially crafted XML documents including external entity references. 2) Some errors related to login mechanism of ZendOpenId and Zend_OpenId consumer can be exploited to impersonate otherwise restricted users/identities without knowing any credentials and secrets. The vulnerabilities are reported in versions prior to 1.12.4. Solution: Update to version 1.12.4. Provided and/or discovered by: The vendor credits: 1) Lukas Reschke. 2) Christian Mainka and Vladislav Mladenov, Ruhr-University Bochum. Original Advisory: http://framework.zend.com/security/advisory/ZF2014-01 http://framework.zend.com/security/advisory/ZF2014-02 @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
+*ZendFramework-1.12.9 (07 Oct 2014) + + 07 Oct 2014; <grknight@gentoo.org> +ZendFramework-1.12.9.ebuild, + -ZendFramework-1.11.6.ebuild: + Version bump for wrt bug 448576 and security bugs 451060, 505276 and 523198 Should be OK to stable as it keeps backwards compatibility with the 1.11 series
Being Stabilized as part of Bug #523198
CVE-2014-2685 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2685): The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider. CVE-2014-2684 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2684): The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 does not verify that the openid_op_endpoint value identifies the same Identity Provider as the provider used in the association handle, which allows remote attackers to bypass authentication and spoof arbitrary OpenID identities by using a malicious OpenID Provider that generates OpenID tokens with arbitrary identifier and claimed_id values. CVE-2014-2683 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2683): Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to cause a denial of service (CPU consumption) via (1) recursive or (2) circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-6532. CVE-2014-2682 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2682): Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0, when PHP-FPM is used, does not properly share the libxml_disable_entity_loader setting between threads, which might allow remote attackers to conduct XML External Entity (XXE) attacks via an XML external entity declaration in conjunction with an entity reference. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657. CVE-2014-2681 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2681): Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.
Arches, Thank you for your work. GLSA Vote: No Cleaned up as part of Bug 523198
GLSA vote: no. Closing as [noglsa]
