[Koha] SECURITY release: MARC::File::XML 1.0.2

[David Cook]

Hi Galen:

If/when libmarc-xml-perl gets added to debian.koha-community.org, will Koha
users who installed via the Debian packages get the update automatically?

-David

-----Original Message-----
Message: 4
Date: Tue, 21 Jan 2014 10:32:23 -0800
From: Galen Charlton <gmc at esilibrary.com>
To: Koha-List <koha at lists.katipo.co.nz>
Subject: [Koha] SECURITY release: MARC::File::XML 1.0.2
Message-ID:
	<CAPLnt652-mSU3RHD3=ZMX7iJAxJMeBNJAu0EZesymmJVhc2LJg at mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1

Hi,

I have uploaded [1] version 1.0.2 of MARC::File::XML, a Perl module
which is used by Koha. This is a security release that repairs an XML
external entity (XXE) vulnerability.  I know of at least one way that
the vulnerability could be used by an individual who has staff
interface credentials to view the contents of arbitrary files on the
Koha server.

Consequently, I recommend that Koha users arrange to upgrade
MARC::File::XML promptly.  On many Linux systems, this can be done by
running the following command with root privileges:

cpan MARC::File::XML

If the installation fails, the most likely reason is that your version
of ExtUtils::MakeMaker is not recent enough.  You can fix this by
running the following command first, then attempting the installation
of MARC::File::XML again.

cpan ExtUtils::MakeMaker

Please note that at the time of this writing, not all CPAN mirrors
will have the most recent version of MARC::File::XML.

You can check the version of MARC::File::XML that is installed by running:

perl -MMARC::File::XML -e 'print $MARC::File::XML::VERSION, "\n"'

I imagine that an updated Debian package of libmarc-xml-perl will be
made available on debian.koha-community.org at some point as well.
For any users of Koha on Fedora that are out there, Dan Scott will be
packaging MARC::File::XML 1.0.2 shortly.

Please note that older releases of MARC::File::XML prior to the switch
to XML::LibXML are also vulnerable.

Here is the relevant change log entry:

1.0.2 Tue Jan 21 17:18:37 UTC 2014
       - MARC::File::XML will now die upon parsing a record that
         declares an external entity and tries to use it. This
         prevents the potential unwanted disclosure of the contents
         of files on the server by applications that embed this module.
         If, for some reason, an application needs to process MARCXML
         records that contain external entities, set_parser() can be
         used to force the use of an XML::LibXML parser that is
         configured to process external entities.

         The issue was reported by John Lightsey.

[1] https://metacpan.org/release/GMCHARLT/MARC-XML-1.0.2

Regards,

Galen
-- 
Galen Charlton
Manager of Implementation
Equinox Software, Inc. / The Open Source Experts
email:  gmc at esilibrary.com
direct: +1 770-709-5581
cell:   +1 404-984-4366
skype:  gmcharlt
web:    http://www.esilibrary.com/
Supporting Koha and Evergreen: http://koha-community.org &
http://evergreen-ils.org