perl-XML-Twig: The option to `expand_external_ents`, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option's setting.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - perl-XML-Twig:  expand_external_ents option fails to work as documented (CVE-2016-9180)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - perl-XML-Twig:  expand_external_ents option fails to work as documented (CVE-2016-9180)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - perl-XML-Twig:  expand_external_ents option fails to work as documented (CVE-2016-9180)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

According to the version of the perl-XML-Twig package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - perl-XML-Twig: The option to `expand_external_ents`,     documented as controlling external entity expansion in     XML::Twig does not work. External entities are always     expanded, regardless of the option's     setting.(CVE-2016-9180)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for perl-XML-Twig fixes the following issues :

  - Security fix [bsc#1008644, CVE-2016-9180]

  - Setting expand_external_ents to 0 or -1 currently     doesn't work as expected; To completely turn off     expanding external entities use no_xxe.

  - Update documentation for XML::Twig to mention problems     with expand_external_ents and add information about new     no_xxe argument

This update was imported from the SUSE:SLE-15:Update update project.

perl-XML-Twig: The option to `expand_external_ents`, documented as controlling external entity expansion in XML::Twig does not work.
External entities are always expanded, regardless of the option's setting. (CVE-2016-9180)

Impact

An authenticated user with a BIG-IP ASM administrative role, such as Policy Editor, may be able to craft an XML message which, when processed by the ASMConfig process using perl-XML-Twig , maycause a denial of service (DoS) orpotentially aninformation disclosure.

ID	Name	Product	Family	Severity
199234	RHEL 6 : perl-xml-twig (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199175	RHEL 7 : perl-xml-twig (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199137	RHEL 5 : perl-xml-twig (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
146761	EulerOS 2.0 SP2 : perl-XML-Twig (EulerOS-SA-2021-1344)	Nessus	Huawei Local Security Checks	critical
146188	EulerOS 2.0 SP5 : perl-XML-Twig (EulerOS-SA-2021-1224)	Nessus	Huawei Local Security Checks	critical
145104	EulerOS 2.0 SP3 : perl-XML-Twig (EulerOS-SA-2021-1110)	Nessus	Huawei Local Security Checks	critical
139647	openSUSE Security Update : perl-XML-Twig (openSUSE-2020-1204)	Nessus	SuSE Local Security Checks	critical
139477	openSUSE Security Update : perl-XML-Twig (openSUSE-2020-1177)	Nessus	SuSE Local Security Checks	critical
105467	F5 Networks BIG-IP : perl-XML-Twig vulnerability (K08383757)	Nessus	F5 Networks Local Security Checks	critical

Detections

Analytics

CVE-2016-9180

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical