Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 598764 (CVE-2016-9180) - <dev-perl/XML-Twig-3.520.0: XXe (CVE-2016-9180)
Summary: <dev-perl/XML-Twig-3.520.0: XXe (CVE-2016-9180)
Status: RESOLVED FIXED
Alias: CVE-2016-9180
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://rt.cpan.org/Public/Bug/Displa...
Whiteboard: B3 [noglsa cve]
Keywords:
Depends on:
Blocks: 600818
  Show dependency tree
 
Reported: 2016-11-02 10:49 UTC by Agostino Sarubbo
Modified: 2017-05-27 00:12 UTC (History)
2 users (show)

See Also:
Package list:
=dev-perl/XML-Twig-3.520.0
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2016-11-02 10:49:01 UTC 
From ${URL} :

The option to `expand_external_ents`, documented as controlling external entity
expansion in XML::Twig does not work.  External entities are always expanded,
regardless of the option's setting.

Upstream bug:

https://rt.cpan.org/Public/Bug/Display.html?id=118097


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Kent Fredric (IRC: kent\n) (RETIRED) gentoo-dev 2016-11-25 13:38:59 UTC 
Upstream have added a new "no_xxe" flag, which seems to be necessary for consuming code to not be vulnerable, so at this stage, it looks like we need
to find things that use XML-Twig[1] and fix them.
Direct responses to *solving* this CVE aren't entirely clear though.

[1]: https://qa-reports.gentoo.org/output/genrdeps/rindex/dev-perl/XML-Twig

commit a8c9d23a38a9c19d21033b5834b660f8340f187e
Author: Kent Fredric <kentnl@gentoo.org>
Date:   Sat Nov 26 02:32:47 2016 +1300

    dev-perl/XML-Twig: Bump to version 3.520.0 (re bug #598764)
    
    - EAPI6
    - Parallel Testing
    - Author test cleanup
    
    Upstream:
    - New option "no_xxe" for XML::Twig->new, which causes the parse to
      fail if external entities are used. (See CVE-2016-9180)
    - Fix warnings/errors with unescaped regex braces.
    - Partial fixes for getNamespaces in XML::Twig::XPath::Elt
Comment 2 Thomas Deutschmann (RETIRED) gentoo-dev 2016-11-25 16:31:48 UTC 
Hell yeah, looks like the Gentoo list is incomplete (maybe missing rdepends in the ebuild), see https://codesearch.debian.net/search?q=Twig-%3Enew ... OK, I'll create a tracker bug.


@ Maintainer(s): Can we already stabilize =dev-perl/XML-Twig-3.520.0?
Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev 2016-11-25 17:55:17 UTC 
Tracker bug created, see bug 600818.
Comment 4 Thomas Deutschmann (RETIRED) gentoo-dev 2016-12-04 00:06:48 UTC 
@ Arches,

please test and mark stable: =dev-perl/XML-Twig-3.520.0

Please honor ALLARCHES keyword!
Comment 5 Tobias Klausmann (RETIRED) gentoo-dev 2016-12-05 15:49:12 UTC 
Stable on alpha.
Comment 6 Agostino Sarubbo gentoo-dev 2016-12-05 18:59:08 UTC 
Stable for amd64/ia64/perl/ppc64/ppc/sparc/x86 (ALLARCHES policy).
Comment 7 Thomas Deutschmann (RETIRED) gentoo-dev 2017-01-09 18:21:57 UTC 
GLSA Vote: No


@ Maintainer(s): Please cleanup and drop <dev-perl/XML-Twig-3.520.0!
Comment 8 Aaron Bauman (RETIRED) gentoo-dev 2017-02-01 02:46:13 UTC 
@perl, bump for cleanup.
Comment 9 Yury German Gentoo Infrastructure gentoo-dev 2017-05-27 00:12:55 UTC 
Arches and Maintainer(s), Thank you for your work.