[xml] Security fix for libxml2

  Bad news, when checking against recursive entities expansion problem
back when it was made official (c.f. the billion laught attack circa
2004) I had checked for the normal recursion, but when happening in
an attribute avlue the resource consumption is way faster and the
recursion detection in place is not sufficient to catch the problem.

  Basically when this happen within an attribute just checking for
a recursion depth is not sufficient, and the only good method I could
find was to count the number of entities replacement taking place while
parsing a given document, and drop parsing after half a million
substitution. I think it's a fair default processand what the patches
below implements for various libxml2 versions, but i can understand that
in some case that may be problematic. So i intend in the next release
(2.7.0 hopefully available soon) to add a parser flag removing the
hardcoded limits (there is also a maximum document depth in place).

  Distributions have been made aware of the problem for a couple of
weeks and updates should be available soon from normal update channels
I'm updating SVN with the fix too,


Red Hat Virtualization group http://redhat.com/virtualization/
Daniel Veillard      | virtualization library  http://libvirt.org/
veillard redhat com  | libxml GNOME XML XSLT toolkit  http://xmlsoft.org/
http://veillard.com/ | Rpmfind RPM search engine  http://rpmfind.net/

Attachment: libxml2-2.6.32-billion_laught.patch
Description: Text document

Attachment: libxml2-2.6.26-billion_laught.patch
Description: Text document

Attachment: libxml2-2.6.16-billion_laught.patch
Description: Text document

Attachment: libxml2-2.5.10-billion_laught.patch
Description: Text document

Attachment: libxml2-2.4.19-billion_laught.patch
Description: Text document

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]