Florian Weimer of the Red Hat Product Security Team reported that tSoapMessage::setContent(const QByteArray &) does not initialize the QDomDocument object it uses for XML parsing in such a way that entity expansion does not occur. At the very least, this results in a denial of service vulnerability because this function is used to parse XML data received over the network.
BZ references old Qt tracker as "Qt Bug Tracker", so references added by Florian should be: https://bugs.kde.org/show_bug.cgi?id=311680 https://bugreports.qt-project.org/browse/QTBUG-29019
Furthermore, QtXml has an XML spec compliance issue which causes it to accept this document (well, it tries its best at it): <https://git.fedorahosted.org/cgit/secure-coding.git/tree/defensive-coding/src/data/XML-Parser-Internal_Regexp_3.xml> See <http://www.w3.org/TR/REC-xml/#sec-prolog-dtd>: " Well-formedness constraint: PEs in Internal Subset In the internal DTD subset, parameter-entity references MUST NOT occur within markup declarations; they may occur where markup declarations can occur. (This does not apply to references that occur in external parameter entities or to the external subset.) "
Removing external tracker bug with the id '29019' as it is not valid for this tracker
Semi-public via: https://codereview.qt-project.org/70345
This is now public via: http://lists.qt-project.org/pipermail/announce/2013-December/000036.html
Created qtsoap tracking bugs for this issue: Affects: fedora-all [bug 1076295] Affects: epel-6 [bug 1076296]
Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.