Bug 1709697 (CVE-2019-11068)

Summary:	CVE-2019-11068 libxslt: xsltCheckRead and xsltCheckWrite routines security bypass by crafted URL
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	apevec, apmukher, dbecker, dking, erik-fedora, igor.raits, jjoyce, jschluet, klember, lhh, lpeer, mburns, rhos-maint, rjones, sclewis, sisharma, slinaber, tvainio, veillard, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-09-29 21:57:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1709698, 1709699, 1712256, 1712658, 1712659, 1712660, 1712661, 1715731, 1715732, 1921195, 1921196, 1921197
Bug Blocks:	1709700

Description Dhananjay Arunesh 2019-05-14 07:37:47 UTC

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.

Upstream commit:
https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6

Comment 1 Dhananjay Arunesh 2019-05-14 07:38:49 UTC

Created libxslt tracking bugs for this issue:

Affects: fedora-all [bug 1709698]


Created mingw-libxslt tracking bugs for this issue:

Affects: fedora-all [bug 1709699]

Comment 4 Huzaifa S. Sidhpurwala 2019-05-31 06:06:41 UTC

This is basically a flaw in how errors are propagated in libxslt. Both xsltCheckRead and xsltCheckWrite functions return -1 in case of errors. For example when invalid urls are passed to both the functions they would return -1 to their calling functions. However callers dont check for this error and continue processing as if no error was received and the URL was valid. This could cause a security bypass ie invalid/malicious URLs considered valid and processed. 

An application which uses the above API, and allows attackers to load arbitrary URLs would be vulnerable. Therefore this flaw is rated as having moderate impact.

Comment 6 Joshua Padman 2019-06-05 01:55:05 UTC

Statement:

Red Hat OpenStack will consume fixes from the base Red Hat Enterprise Linux Operating System. Therefore the package provided by Red Hat OpenStack has been marked as will not fix.

Comment 7 Huzaifa S. Sidhpurwala 2020-01-29 08:11:52 UTC

Mitigation:

This flaw only applies to applications compiled against libxml2 which use xsltCheckRead and xsltCheckWrite functions and/or allow users to load arbitrary URLs to be parsed via libxml2. In all other cases, applications are not vulnerable.

Comment 8 errata-xmlrpc 2020-09-29 20:31:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:4005 https://access.redhat.com/errata/RHSA-2020:4005

Comment 9 Product Security DevOps Team 2020-09-29 21:57:56 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-11068

Comment 10 errata-xmlrpc 2020-11-04 01:13:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:4464 https://access.redhat.com/errata/RHSA-2020:4464