CVE-2017-1000190: XXE vulnerability resulting in SSRF, information disclosure, DoS, etc.

Debian Bug report logs - #888547
CVE-2017-1000190: XXE vulnerability resulting in SSRF, information disclosure, DoS, etc.

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2017-1000190

Date: Sat, 27 Jan 2018 00:14:19 +0100

Source: simple-xml
Severity: important
Tags: security

CVE-2017-1000190 has been assigned to this bug in simple-xml:
https://github.com/ngallagher/simplexml/issues/18

Cheers,
        Moritz

Message #18 received at 888547@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>

To: 888547@bugs.debian.org

Subject: Re: CVE-2017-1000190

Date: Thu, 23 Aug 2018 13:14:17 +0200

[Message part 1 (text/plain, inline)]

Apparently upstream doesn't consider this "to be their problem". Since
simple-xml has no reverse-dependencies and the current uploader is MIA,
I think we should consider requesting the removal of simple-xml.

Markus

[signature.asc (application/pgp-signature, attachment)]

Message #23 received at 888547@bugs.debian.org (full text, mbox, reply):

From: Emmanuel Bourg <ebourg@apache.org>

To: 888547@bugs.debian.org

Subject: Re: CVE-2017-1000190

Date: Thu, 23 Aug 2018 15:55:22 +0200

On 23/08/2018 13:14, Markus Koschany wrote:
> Apparently upstream doesn't consider this "to be their problem". Since
> simple-xml has no reverse-dependencies and the current uploader is MIA,
> I think we should consider requesting the removal of simple-xml.

simple-xml is a dependency of carrotsearch-randomizedtesting.

The fix should be trivial, it's just a matter of disabling external
entities parsing on the underlying XML parser. And maybe we've already
fixed the XML parser used by default.

Emmanuel Bourg

Message #28 received at 888547@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>

To: 888547@bugs.debian.org

Subject: Re: Bug#888547: CVE-2017-1000190

Date: Thu, 23 Aug 2018 17:11:11 +0200

[Message part 1 (text/plain, inline)]

Am 23.08.2018 um 15:55 schrieb Emmanuel Bourg:
> On 23/08/2018 13:14, Markus Koschany wrote:
>> Apparently upstream doesn't consider this "to be their problem". Since
>> simple-xml has no reverse-dependencies and the current uploader is MIA,
>> I think we should consider requesting the removal of simple-xml.
> 
> simple-xml is a dependency of carrotsearch-randomizedtesting.
> 
> The fix should be trivial, it's just a matter of disabling external
> entities parsing on the underlying XML parser. And maybe we've already
> fixed the XML parser used by default.

My concern is that we have an upstream project that does not even
consider such a trivial fix. Then we have another example of a
fire-and-forget one time upload (simple-xml) and now the package is
carried "by the team". carrotsearch-randomizedtesting is a
test-dependency for lucence4.10 and spatial4j, same pattern, one time
upload, now carried by the team. And when I see that we ship at least
three versions of lucene in Debian, then I suppose we still have some
room for improvements.

The gist is: Better maintain few packages and do it well, instead of
maintaining many packages that just exist for collecting RC bugs.

Markus

[signature.asc (application/pgp-signature, attachment)]

Message #33 received at 888547@bugs.debian.org (full text, mbox, reply):

From: Emmanuel Bourg <ebourg@apache.org>

To: 888547@bugs.debian.org

Subject: Re: Bug#888547: CVE-2017-1000190

Date: Fri, 24 Aug 2018 01:18:09 +0200

On 23/08/2018 17:11, Markus Koschany wrote:

> My concern is that we have an upstream project that does not even
> consider such a trivial fix. Then we have another example of a
> fire-and-forget one time upload (simple-xml) and now the package is
> carried "by the team". carrotsearch-randomizedtesting is a
> test-dependency for lucence4.10 and spatial4j, same pattern, one time
> upload, now carried by the team. And when I see that we ship at least
> three versions of lucene in Debian, then I suppose we still have some
> room for improvements.

lucene2 is only used by eclipse, I hope we'll be able to remove both of
them before Buster is released. With the new eclipse-* packages heading
to unstable this is now a likely outcome.


> The gist is: Better maintain few packages and do it well, instead of
> maintaining many packages that just exist for collecting RC bugs.

I agree. Not all CVEs are equally important though, here simple-xml is
just a test dependency of another package and has a very low popcon, the
vulnerability has no real impact on the Debian users.

Emmanuel Bourg

Message #40 received at 888547@bugs.debian.org (full text, mbox, reply):

From: Ivo De Decker <ivodd@debian.org>

To: Emmanuel Bourg <ebourg@apache.org>

Cc: 888547@bugs.debian.org

Subject: Re: Bug#888547: CVE-2017-1000190

Date: Sat, 13 Apr 2019 11:31:09 +0200

Hi,

On Fri, Aug 24, 2018 at 01:18:09AM +0200, Emmanuel Bourg wrote:
> On 23/08/2018 17:11, Markus Koschany wrote:
> 
> > My concern is that we have an upstream project that does not even
> > consider such a trivial fix. Then we have another example of a
> > fire-and-forget one time upload (simple-xml) and now the package is
> > carried "by the team". carrotsearch-randomizedtesting is a
> > test-dependency for lucence4.10 and spatial4j, same pattern, one time
> > upload, now carried by the team. And when I see that we ship at least
> > three versions of lucene in Debian, then I suppose we still have some
> > room for improvements.
> 
> lucene2 is only used by eclipse, I hope we'll be able to remove both of
> them before Buster is released. With the new eclipse-* packages heading
> to unstable this is now a likely outcome.
> 
> 
> > The gist is: Better maintain few packages and do it well, instead of
> > maintaining many packages that just exist for collecting RC bugs.
> 
> I agree. Not all CVEs are equally important though, here simple-xml is
> just a test dependency of another package and has a very low popcon, the
> vulnerability has no real impact on the Debian users.

It is possible to remove the test-dependency (probably by disabling the
tests)? That way simple-xml could be removed from buster. Even if we don't do
this for buster, it might be good to do this for bullseye anyway, if the
package isn't really maintained.

Thanks,

Ivo

Message #45 received at 888547@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>

To: Ivo De Decker <ivodd@debian.org>

Cc: 888547@bugs.debian.org, Emmanuel Bourg <ebourg@apache.org>

Subject: Re: Bug#888547: CVE-2017-1000190

Date: Sun, 14 Apr 2019 23:27:12 +0200

[Message part 1 (text/plain, inline)]

Hi,

Am 13.04.19 um 11:31 schrieb Ivo De Decker:
[...]
> It is possible to remove the test-dependency (probably by disabling the
> tests)? That way simple-xml could be removed from buster. Even if we don't do
> this for buster, it might be good to do this for bullseye anyway, if the
> package isn't really maintained.

Simple-xml is only required to build carrotsearch-randomizedtesting. It
is not a test-dependency though. However I have just disabled the only
module in carrotsearch-randomizedtesting that uses simple-xml, which is
junit4-ant.

If we do that then lucene4.10 will FTBFS but it requires only a simple
patch to tell the build system not to look for the now missing
junit4-ant dependency. Apparently the removal makes no difference for
lucene4.10. I can implement those changes in the coming days.

Regards,

Markus

[signature.asc (application/pgp-signature, attachment)]

Message #50 received at 888547@bugs.debian.org (full text, mbox, reply):

From: Emmanuel Bourg <ebourg@apache.org>

To: Markus Koschany <apo@debian.org>, Ivo De Decker <ivodd@debian.org>

Cc: 888547@bugs.debian.org

Subject: Re: Bug#888547: CVE-2017-1000190

Date: Sun, 14 Apr 2019 23:57:26 +0200

Le 14/04/2019 à 23:27, Markus Koschany a écrit :

> Simple-xml is only required to build carrotsearch-randomizedtesting. It
> is not a test-dependency though.

> Apparently the removal makes no difference for lucene4.10.

Indeed, because carrotsearch-randomizedtesting is just a test dependency
of lucene4.10.

Emmanuel Bourg

Message #55 received at 888547@bugs.debian.org (full text, mbox, reply):

From: Ivo De Decker <ivodd@debian.org>

To: Emmanuel Bourg <ebourg@apache.org>

Cc: Markus Koschany <apo@debian.org>, Ivo De Decker <ivodd@debian.org>, 888547@bugs.debian.org

Subject: Re: Bug#888547: CVE-2017-1000190

Date: Mon, 22 Apr 2019 12:19:14 +0200

Hi,

On Sun, Apr 14, 2019 at 11:57:26PM +0200, Emmanuel Bourg wrote:
> Le 14/04/2019 à 23:27, Markus Koschany a écrit :
> 
> > Simple-xml is only required to build carrotsearch-randomizedtesting. It
> > is not a test-dependency though.
> 
> > Apparently the removal makes no difference for lucene4.10.
> 
> Indeed, because carrotsearch-randomizedtesting is just a test dependency
> of lucene4.10.

Thanks for the changes allowing simple-xml to be removed. I added a removal
hint so simple-xml should be out of testing soon.

Ivo

Send a report that this bug log contains spam.