CVE request: Perl XML::LibXML

[Tilmann Haak <tilmann.haak () xing com>]

Hi oss-sec,

I'd like to request a CVE number for an XEE vulnerability in Perl's XML::LibXML.

According to XML::LibXML's documentation it should be possible to
disable processing of external entities by using the "expand_entities" parameter.

Two example scripts are attached to this mail. The 
output of XEE-XML-LibXML-demo.pl should not contain external 
entities, but "expand_entities" is ignored. The output 
of XEE-XML-LibXML-demo2.pl is as expected (no external entities).

The behaviour depends on how the XML is loaded.
Using "$XML_DOC = XML::LibXML->load_xml" works as documented, using 
$parser = XML::LibXML->new and $XML_DOC = $parser->load_xml does not.

I've tested the issue on two platforms and was able to print out the 
system's "/etc/passwd" file.


Ubuntu 12.04.5 LTS
Perl version: v5.14.2
libxml2 version: 2.7.8
XML::LibXML version: 1.89

Mac OS X 10.9.5
Perl version: v5.16.2
libxml2 version: 2.9.0
XML::LibXML version: 2.0118


The vulnerability is fixed in version 2.0119.
I'm not sure which older versions are affected, however the vulnerability is present in version 1.89 and probably older 
versions, too.

The fix:
<https://bitbucket.org/shlomif/perl-xml-libxml/commits/5962fd067580767777e94640b129ae8930a68a30>

Changelog:
<http://cpansearch.perl.org/src/SHLOMIF/XML-LibXML-2.0119/Changes>

I'm not aware of other CVE requests.


Thanks in advance,
  Tilmann Haak

Attachment: XEE-XML-LibXML-demo.pl
Description: XEE-XML-LibXML-demo.pl

Attachment: XEE-XML-LibXML-demo2.pl
Description: XEE-XML-LibXML-demo2.pl