Bug 1216112 (CVE-2015-3451)

Summary: CVE-2015-3451 perl-XML-LibXML: "expand_entities" option was not preserved under some circumstances
Product: [Other] Security Response Reporter: Vasyl Kaigorodov <vkaigoro>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: carnil, jplesnik, jrusnack, mmaslano, perl-devel, perl-maint-list, ppisar, psabata
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: perl-XML-LibXML 2.0119 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-08-07 00:01:21 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1216114    
Bug Blocks: 1216113    

Description Vasyl Kaigorodov 2015-04-28 14:02:26 UTC
It was reported that perl-XML-LibXML did ignore "expand_entities" option in some circumstances, which could lead to sensitive information disclosure.
Original report and CVE request (reprodcuers are also available):
http://seclists.org/oss-sec/2015/q2/280

Comment 1 Vasyl Kaigorodov 2015-04-28 14:06:14 UTC
Created perl-XML-LibXML tracking bugs for this issue:

Affects: fedora-all [bug 1216114]

Comment 2 Fedora Update System 2015-05-10 23:34:10 UTC
perl-XML-LibXML-2.0119-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 3 Kurt Seifried 2015-08-07 00:01:02 UTC
Mitigations:

This issue only affects programs using this program in forms such as:

$parser = XML::LibXML->new

or 

$XML_DOC = $parser->load_xml

if you use the form:

$XML_DOC = XML::LibXML->load_xml

this vulnerability will not be exposed.

Comment 4 Kurt Seifried 2015-08-07 00:01:21 UTC
Statement:

This issue affects the versions of perl-XML-LibXML as shipped with Red Hat Enterprise Linux 5, 6 and 7. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.