Bug 13953 - Bad QueryParser YAML config + old version of YAML::XS can cause segfault
Summary: Bad QueryParser YAML config + old version of YAML::XS can cause segfault
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: 3.18
Hardware: All All
: P5 - low minor (vote)
Assignee: Galen Charlton
QA Contact: Testopia
Depends on:
Blocks: 12742
  Show dependency treegraph
Reported: 2015-04-03 13:46 UTC by Galen Charlton
Modified: 2021-12-13 21:08 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Note You need to log in before you can comment on or make changes to this bug.
Description Galen Charlton 2015-04-03 13:46:29 UTC
A system that happens to have an old version of YAML::XS that does not have the fix for CVE-2014-9130 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9130) can be subject to having processes that invoke a catalog search segfault if the following conditions are met:

- QueryParser is enabled
- etc/searchengine/queryparser.yaml is malformed in such a way as to trigger the assert that's the subject of the CVE
- YAML::XS is installed on the system and is either older than version 0.53 or didn't get the fix backpatched by the distro

The following mitigations are available:

- first, fix queryparser.yaml
- install a more recent version of YAML::XS
- *remove* YAML::XS, in which case YAML::Any will switch to using YAML::Syck

This bug is filed for informational purposes; since changes to queryparser.yaml have to be done on the filesystem, and since as near as I can tell, other uses of YAML are parsed using YAML::Syck or the pure-perl YAML module, I don't see there being a remote exploit.
Comment 1 Owen Leonard 2016-06-21 15:47:51 UTC
Is this bug relevant to versions newer than 3.18.x? If not, can we close it since 3.18.x is now unmaintained?
Comment 2 Katrin Fischer 2020-02-24 20:45:20 UTC
We've voted to remove QueryParser, but the description here is also referring to elasticsearch in the paths - do we still need to fix this?