Bug 1709697 (CVE-2019-11068) - CVE-2019-11068 libxslt: xsltCheckRead and xsltCheckWrite routines security bypass by crafted URL
Summary: CVE-2019-11068 libxslt: xsltCheckRead and xsltCheckWrite routines security by...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-11068
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1709698 1709699 1712256 1712658 1712659 1712660 1712661 1715731 1715732 1921195 1921196 1921197
Blocks: 1709700
TreeView+ depends on / blocked
 
Reported: 2019-05-14 07:37 UTC by Dhananjay Arunesh
Modified: 2023-12-15 16:30 UTC (History)
20 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-09-29 21:57:56 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:4005 0 None None None 2020-09-29 20:31:26 UTC
Red Hat Product Errata RHSA-2020:4464 0 None None None 2020-11-04 01:13:59 UTC

Description Dhananjay Arunesh 2019-05-14 07:37:47 UTC 
libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.

Upstream commit:
https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6
Comment 1 Dhananjay Arunesh 2019-05-14 07:38:49 UTC 
Created libxslt tracking bugs for this issue:

Affects: fedora-all [bug 1709698]


Created mingw-libxslt tracking bugs for this issue:

Affects: fedora-all [bug 1709699]
Comment 4 Huzaifa S. Sidhpurwala 2019-05-31 06:06:41 UTC 
This is basically a flaw in how errors are propagated in libxslt. Both xsltCheckRead and xsltCheckWrite functions return -1 in case of errors. For example when invalid urls are passed to both the functions they would return -1 to their calling functions. However callers dont check for this error and continue processing as if no error was received and the URL was valid. This could cause a security bypass ie invalid/malicious URLs considered valid and processed. 

An application which uses the above API, and allows attackers to load arbitrary URLs would be vulnerable. Therefore this flaw is rated as having moderate impact.
Comment 6 Joshua Padman 2019-06-05 01:55:05 UTC 
Statement:

Red Hat OpenStack will consume fixes from the base Red Hat Enterprise Linux Operating System. Therefore the package provided by Red Hat OpenStack has been marked as will not fix.
Comment 7 Huzaifa S. Sidhpurwala 2020-01-29 08:11:52 UTC 
Mitigation:

This flaw only applies to applications compiled against libxml2 which use xsltCheckRead and xsltCheckWrite functions and/or allow users to load arbitrary URLs to be parsed via libxml2. In all other cases, applications are not vulnerable.
Comment 8 errata-xmlrpc 2020-09-29 20:31:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:4005 https://access.redhat.com/errata/RHSA-2020:4005
Comment 9 Product Security DevOps Team 2020-09-29 21:57:56 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-11068
Comment 10 errata-xmlrpc 2020-11-04 01:13:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:4464 https://access.redhat.com/errata/RHSA-2020:4464
Note You need to log in before you can comment on or make changes to this bug.