A system that happens to have an old version of YAML::XS that does not have the fix for CVE-2014-9130 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9130) can be subject to having processes that invoke a catalog search segfault if the following conditions are met:
- QueryParser is enabled
- etc/searchengine/queryparser.yaml is malformed in such a way as to trigger the assert that's the subject of the CVE
- YAML::XS is installed on the system and is either older than version 0.53 or didn't get the fix backpatched by the distro
The following mitigations are available:
- first, fix queryparser.yaml
- install a more recent version of YAML::XS
- *remove* YAML::XS, in which case YAML::Any will switch to using YAML::Syck
This bug is filed for informational purposes; since changes to queryparser.yaml have to be done on the filesystem, and since as near as I can tell, other uses of YAML are parsed using YAML::Syck or the pure-perl YAML module, I don't see there being a remote exploit.
Is this bug relevant to versions newer than 3.18.x? If not, can we close it since 3.18.x is now unmaintained?
We've voted to remove QueryParser, but the description here is also referring to elasticsearch in the paths - do we still need to fix this?