Bug 955375 (CVE-2013-4549)

Summary:	CVE-2013-4549 QtXML: XML entity expansion denial of service
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	fweimer, jrusnack, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-01-20 18:08:44 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	955255, 1076295, 1076296
Bug Blocks:	955378

Description Vincent Danen 2013-04-22 22:35:45 UTC

Florian Weimer of the Red Hat Product Security Team reported that tSoapMessage::setContent(const QByteArray &) does not initialize the QDomDocument object it uses for XML parsing in such a way that entity expansion does not occur.  At the very least, this results in a denial of service vulnerability because this function is used to parse XML data received over the network.

Comment 2 Tomas Hoger 2013-04-24 12:33:32 UTC

BZ references old Qt tracker as "Qt Bug Tracker", so references added by Florian should be:

https://bugs.kde.org/show_bug.cgi?id=311680
https://bugreports.qt-project.org/browse/QTBUG-29019

Comment 6 Florian Weimer 2013-04-30 09:26:35 UTC

Furthermore, QtXml has an XML spec compliance issue which causes it to accept this document (well, it tries its best at it):

<https://git.fedorahosted.org/cgit/secure-coding.git/tree/defensive-coding/src/data/XML-Parser-Internal_Regexp_3.xml>

See <http://www.w3.org/TR/REC-xml/#sec-prolog-dtd>:

"
Well-formedness constraint: PEs in Internal Subset

In the internal DTD subset, parameter-entity references MUST NOT occur within markup declarations; they may occur where markup declarations can occur. (This does not apply to references that occur in external parameter entities or to the external subset.)
"

Comment 10 Red Hat Bugzilla 2013-10-04 00:22:57 UTC

Removing external tracker bug with the id '29019' as it is not valid for this tracker

Comment 11 Florian Weimer 2013-11-05 12:38:38 UTC

Semi-public via: https://codereview.qt-project.org/70345

Comment 14 Florian Weimer 2013-12-16 17:52:49 UTC

This is now public via:

http://lists.qt-project.org/pipermail/announce/2013-December/000036.html

Comment 16 Murray McAllister 2014-03-14 03:38:20 UTC

Created qtsoap tracking bugs for this issue:

Affects: fedora-all [bug 1076295]
Affects: epel-6 [bug 1076296]

Comment 18 Vincent Danen 2015-01-20 18:08:32 UTC

Statement:

Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.