Bug 831979 – <dev-java/xerces-2.12.2: infinite loop vulnerability

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description John Helmert III 2022-01-24 15:06:51 UTC]

From URL:

"There's a vulnerability within the Apache Xerces Java (XercesJ) XML
parser when handling specially crafted XML document payloads. This
causes, the XercesJ XML parser to wait in an infinite loop, which may
sometimes consume system resources for prolonged duration. This
vulnerability is present within XercesJ version 2.12.1 and the
previous versions.

Mitigation:

Apache XercesJ users, should migrate to version 2.12.2"

Please bump.

[Comment 1 Larry the Git Cow 2022-02-03 12:00:25 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=743111a72f39a1b24f87bd1b2fc32ef707b41407

commit 743111a72f39a1b24f87bd1b2fc32ef707b41407
Author:     Volkmar W. Pogatzki <[e-mail]>
AuthorDate: 2022-02-02 17:30:03 +0000
Commit:     Miroslav Šulc <[e-mail]>
CommitDate: 2022-02-03 12:00:09 +0000

    dev-java/xerces: Bump to 2.12.2
    
    Closes: https://bugs.gentoo.org/831155
    Bug: https://bugs.gentoo.org/831979
    Package-Manager: Portage-3.0.30, Repoman-3.0.3
    Signed-off-by: Volkmar W. Pogatzki <[e-mail]>
    Signed-off-by: Miroslav Šulc <[e-mail]>

 dev-java/xerces/Manifest             |  1 +
 dev-java/xerces/metadata.xml         | 11 ++++---
 dev-java/xerces/xerces-2.12.2.ebuild | 57 ++++++++++++++++++++++++++++++++++++
 3 files changed, 65 insertions(+), 4 deletions(-)

[Comment 2 Miroslav Šulc 2022-02-03 12:06:06 UTC]

thanks vaukai for the bump. let's give it a few days before we start the stabilization process as we don't have tests for this package.

[Comment 3 John Helmert III 2022-02-04 00:26:26 UTC]

No worries, thanks!

[Comment 4 Larry the Git Cow 2022-03-06 17:07:53 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=610e8e15e38b5c213227f1dabdcddfdf60e66095

commit 610e8e15e38b5c213227f1dabdcddfdf60e66095
Author:     Volkmar W. Pogatzki <[e-mail]>
AuthorDate: 2022-03-06 16:29:41 +0000
Commit:     Florian Schmaus <[e-mail]>
CommitDate: 2022-03-06 17:07:45 +0000

    dev-java/xerces: Drop 2.12.0-r1
    
    Closes: https://bugs.gentoo.org/831155
    Bug: https://bugs.gentoo.org/831979
    Package-Manager: Portage-3.0.30, Repoman-3.0.3
    Signed-off-by: Volkmar W. Pogatzki <[e-mail]>
    Closes: https://github.com/gentoo/gentoo/pull/24424
    Signed-off-by: Florian Schmaus <[e-mail]>

 dev-java/xerces/Manifest                |  1 -
 dev-java/xerces/xerces-2.12.0-r1.ebuild | 55 ---------------------------------
 2 files changed, 56 deletions(-)

[Comment 5 John Helmert III 2022-03-06 18:15:35 UTC]

Thanks! Minimal impact so no GLSA. All done!