Bug 417351 – <dev-python/feedparser-5.1.2 DOCTYPE and ENTITY XML Declaration Denial of Service (CVE-2012-2921)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Michael Harrison 2012-05-24 08:04:07 UTC]

An error when handling DOCTYPE and ENTITY XML declarations can be exploited to cause a high memory resource consumption via a non-ASCII-compatible encoded document.

The vulnerability is reported in versions prior to 5.1.2.

Solution
Update to version 5.1.2

Original Advisory
http://freecode.com/projects/feedparser/releases/344371
https://code.google.com/p/feedparser/source/detail?r=703&path=/trunk/feedparser/feedparser.py

[Comment 1 Tim Sammut (RETIRED) 2012-05-24 18:54:18 UTC]

@python, ok to stabilize =dev-python/feedparser-5.1.2?

[Comment 2 Mike Gilbert 2012-05-24 19:48:05 UTC]

(In reply to comment #1)

Looks good to me.

[Comment 3 Tim Sammut (RETIRED) 2012-05-24 19:50:44 UTC]

Great, thank you.

Arches, please test and mark stable:
=dev-python/feedparser-5.1.2
Target keywords : "alpha amd64 ia64 ppc ppc64 sparc x86"

[Comment 4 Agostino Sarubbo 2012-05-25 08:58:10 UTC]

amd64 stable

[Comment 5 Raúl Porcel (RETIRED) 2012-05-26 17:15:50 UTC]

alpha/ia64/sparc/x86 stable

[Comment 6 Brent Baude (RETIRED) 2012-06-06 14:07:19 UTC]

ppc64 done

[Comment 7 Brent Baude (RETIRED) 2012-06-08 18:09:14 UTC]

ppc done

[Comment 8 Tim Sammut (RETIRED) 2012-06-10 15:32:13 UTC]

Thanks, folks. GLSA Vote: no.

[Comment 9 Sean Amoss (RETIRED) 2012-06-11 20:03:41 UTC]

GLSA vote: no.

Closing noglsa.