Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.

Bug 1216112 (CVE-2015-3451)

Summary:	CVE-2015-3451 perl-XML-LibXML: "expand_entities" option was not preserved under some circumstances
Product:	[Other] Security Response	Reporter:	Vasyl Kaigorodov <vkaigoro>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	carnil, jplesnik, jrusnack, mmaslano, perl-devel, perl-maint-list, ppisar, psabata
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	perl-XML-LibXML 2.0119	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-08-07 00:01:21 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1216114
Bug Blocks:

Description Vasyl Kaigorodov 2015-04-28 14:02:26 UTC

It was reported that perl-XML-LibXML did ignore "expand_entities" option in some circumstances, which could lead to sensitive information disclosure.
Original report and CVE request (reprodcuers are also available):
http://seclists.org/oss-sec/2015/q2/280

Comment 1 Vasyl Kaigorodov 2015-04-28 14:06:14 UTC

Created perl-XML-LibXML tracking bugs for this issue:

Affects: fedora-all [bug 1216114]

Comment 2 Fedora Update System 2015-05-10 23:34:10 UTC

perl-XML-LibXML-2.0119-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 3 Kurt Seifried 2015-08-07 00:01:02 UTC

Mitigations:

This issue only affects programs using this program in forms such as:

$parser = XML::LibXML->new

or 

$XML_DOC = $parser->load_xml

if you use the form:

$XML_DOC = XML::LibXML->load_xml

this vulnerability will not be exposed.

Comment 4 Kurt Seifried 2015-08-07 00:01:21 UTC

Statement:

This issue affects the versions of perl-XML-LibXML as shipped with Red Hat Enterprise Linux 5, 6 and 7. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.