perl-XML-Twig: The option to `expand_external_ents`, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option's setting.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - perl-XML-Twig: The option to `expand_external_ents`, documented as controlling external entity expansion     in XML::Twig does not work. External entities are always expanded, regardless of the option's setting.
    (CVE-2016-9180)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the version of the perl-XML-Twig package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - perl-XML-Twig: The option to `expand_external_ents`,     documented as controlling external entity expansion in     XML::Twig does not work. External entities are always     expanded, regardless of the option's     setting.(CVE-2016-9180)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for perl-XML-Twig fixes the following issues :

  - Security fix [bsc#1008644, CVE-2016-9180]

  - Setting expand_external_ents to 0 or -1 currently     doesn't work as expected; To completely turn off     expanding external entities use no_xxe.

  - Update documentation for XML::Twig to mention problems     with expand_external_ents and add information about new     no_xxe argument

This update was imported from the SUSE:SLE-15:Update update project.

perl-XML-Twig: The option to `expand_external_ents`, documented as controlling external entity expansion in XML::Twig does not work.
External entities are always expanded, regardless of the option's setting. (CVE-2016-9180)

Impact

An authenticated user with a BIG-IP ASM administrative role, such as Policy Editor, may be able to craft an XML message which, when processed by the ASMConfig process using perl-XML-Twig , maycause a denial of service (DoS) orpotentially aninformation disclosure.

ID	Name	Product	Family	Severity
220138	Linux Distros Unpatched Vulnerability : CVE-2016-9180	Nessus	Misc.	critical
146761	EulerOS 2.0 SP2 : perl-XML-Twig (EulerOS-SA-2021-1344)	Nessus	Huawei Local Security Checks	critical
146188	EulerOS 2.0 SP5 : perl-XML-Twig (EulerOS-SA-2021-1224)	Nessus	Huawei Local Security Checks	critical
145104	EulerOS 2.0 SP3 : perl-XML-Twig (EulerOS-SA-2021-1110)	Nessus	Huawei Local Security Checks	critical
139647	openSUSE Security Update : perl-XML-Twig (openSUSE-2020-1204)	Nessus	SuSE Local Security Checks	critical
139477	openSUSE Security Update : perl-XML-Twig (openSUSE-2020-1177)	Nessus	SuSE Local Security Checks	critical
105467	F5 Networks BIG-IP : perl-XML-Twig vulnerability (K08383757)	Nessus	F5 Networks Local Security Checks	critical

Detections

Analytics

CVE-2016-9180

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical