Bug 13953

Summary:	Bad QueryParser YAML config + old version of YAML::XS can cause segfault
Product:	Koha	Reporter:	Galen Charlton <gmcharlt>
Component:	Architecture, internals, and plumbing	Assignee:	Galen Charlton <gmcharlt>
Status:	CLOSED FIXED	QA Contact:	Testopia <testopia>
Severity:	minor
Priority:	P5 - low	CC:	jonathan.druart
Version:	3.18
Hardware:	All
OS:	All
See Also:	https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27673
Change sponsored?:	---	Patch complexity:	---
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:
Circulation function:
Bug Depends on:
Bug Blocks:	12742

Description Galen Charlton 2015-04-03 13:46:29 UTC

A system that happens to have an old version of YAML::XS that does not have the fix for CVE-2014-9130 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9130) can be subject to having processes that invoke a catalog search segfault if the following conditions are met:

- QueryParser is enabled
- etc/searchengine/queryparser.yaml is malformed in such a way as to trigger the assert that's the subject of the CVE
- YAML::XS is installed on the system and is either older than version 0.53 or didn't get the fix backpatched by the distro

The following mitigations are available:

- first, fix queryparser.yaml
- install a more recent version of YAML::XS
- *remove* YAML::XS, in which case YAML::Any will switch to using YAML::Syck

This bug is filed for informational purposes; since changes to queryparser.yaml have to be done on the filesystem, and since as near as I can tell, other uses of YAML are parsed using YAML::Syck or the pure-perl YAML module, I don't see there being a remote exploit.

Comment 1 Owen Leonard 2016-06-21 15:47:51 UTC

Is this bug relevant to versions newer than 3.18.x? If not, can we close it since 3.18.x is now unmaintained?

Comment 2 Katrin Fischer 2020-02-24 20:45:20 UTC

We've voted to remove QueryParser, but the description here is also referring to elasticsearch in the paths - do we still need to fix this?