Bug 13953

Summary: Bad QueryParser YAML config + old version of YAML::XS can cause segfault
Product: Koha Reporter: Galen Charlton <gmcharlt>
Component: Architecture, internals, and plumbingAssignee: Galen Charlton <gmcharlt>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: minor    
Priority: P5 - low CC: jonathan.druart, katrin.fischer
Version: 3.18   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27673
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 12742    

Description Galen Charlton 2015-04-03 13:46:29 UTC
A system that happens to have an old version of YAML::XS that does not have the fix for CVE-2014-9130 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9130) can be subject to having processes that invoke a catalog search segfault if the following conditions are met:

- QueryParser is enabled
- etc/searchengine/queryparser.yaml is malformed in such a way as to trigger the assert that's the subject of the CVE
- YAML::XS is installed on the system and is either older than version 0.53 or didn't get the fix backpatched by the distro

The following mitigations are available:

- first, fix queryparser.yaml
- install a more recent version of YAML::XS
- *remove* YAML::XS, in which case YAML::Any will switch to using YAML::Syck

This bug is filed for informational purposes; since changes to queryparser.yaml have to be done on the filesystem, and since as near as I can tell, other uses of YAML are parsed using YAML::Syck or the pure-perl YAML module, I don't see there being a remote exploit.
Comment 1 Owen Leonard 2016-06-21 15:47:51 UTC
Is this bug relevant to versions newer than 3.18.x? If not, can we close it since 3.18.x is now unmaintained?
Comment 2 Katrin Fischer 2020-02-24 20:45:20 UTC
We've voted to remove QueryParser, but the description here is also referring to elasticsearch in the paths - do we still need to fix this?