Bug 999687 (CVE-2013-4701)

Summary:	CVE-2013-4701 php-pear-Auth-OpenID: XML External Entity issue allows for reading arbitrary files or excessive resource consumption
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	Axel.Thimm, herrold, jrusnack, kevin, kurt
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-11-04 04:51:07 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	999688
Bug Blocks:

Description Vincent Danen 2013-08-21 21:15:28 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2013-4701 to
the following vulnerability:

Name: CVE-2013-4701
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4701
Assigned: 20130626
Reference: https://github.com/openid/php-openid/commit/625c16bb28bb120d262b3f19f89c2c06cb9b0da9
Reference: JVN:JVN#24713981
Reference: http://jvn.jp/en/jp/JVN24713981/index.html
Reference: JVNDB:JVNDB-2013-000080
Reference: http://jvndb.jvn.jp/jvndb/JVNDB-2013-000080

Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows
remote attackers to read arbitrary files, send HTTP requests to
intranet servers, or cause a denial of service (CPU and memory
consumption) via XRDS data containing an external entity declaration
in conjunction with an entity reference, related to an XML External
Entity (XXE) issue.

Comment 1 Vincent Danen 2013-08-21 21:16:21 UTC

Created php-pear-Auth-OpenID tracking bugs for this issue:

Affects: fedora-all [bug 999688]

Comment 2 Fedora Update System 2013-09-01 23:09:00 UTC

php-pear-Auth-OpenID-2.2.2-7.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 3 Fedora Update System 2013-09-01 23:09:16 UTC

php-pear-Auth-OpenID-2.2.2-7.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2013-09-08 18:40:20 UTC

php-pear-Auth-OpenID-2.2.2-7.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.