Bug 1218651 (CVE-2024-22368) - VUL-0: CVE-2024-22368: perl-Spreadsheet-ParseXLSX: out-of-memory condition during parsing of a crafted XLSX document
Summary: VUL-0: CVE-2024-22368: perl-Spreadsheet-ParseXLSX: out-of-memory condition du...
Status: IN_PROGRESS
Alias: CVE-2024-22368
Product: openSUSE Distribution
Classification: openSUSE
Component: Other (show other bugs)
Version: Leap 15.6
Hardware: Other Other
: P3 - Medium : Normal (vote)
Target Milestone: ---
Assignee: Christian Wittmer
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/390449/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-01-09 14:09 UTC by SMASH SMASH
Modified: 2024-01-16 11:05 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-01-09 14:09:37 UTC
The Spreadsheet::ParseXLSX package before 0.28 for Perl can encounter an out-of-memory condition during parsing of a crafted XLSX document. This occurs because the memoize implementation does not have appropriate constraints on merged cells.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-22368
https://www.cve.org/CVERecord?id=CVE-2024-22368
https://github.com/haile01/perl_spreadsheet_excel_rce_poc/blob/main/parse_xlsx_bomb.md
https://metacpan.org/dist/Spreadsheet-ParseXLSX/changes
Comment 1 Andrea Mattiazzo 2024-01-09 14:19:11 UTC
Patch:
https://github.com/MichaelDaum/spreadsheet-parsexlsx/commit/39b25b91fcb939a9c8ea807fdc80386c1ae5be0c

Tracking as affected:
-openSUSE:Backports:SLE-15-SP5

Assigned to maintainer since bugowner of affected package doesn't have a valid bugzilla account
Comment 2 Christian Wittmer 2024-01-15 09:10:57 UTC
It is already updated here:
https://build.opensuse.org/package/show/devel:languages:perl:CPAN-S/perl-Spreadsheet-ParseXLSX
Comment 3 OBSbugzilla Bot 2024-01-15 15:35:02 UTC
This is an autogenerated message for OBS integration:
This bug (1218651) was mentioned in
https://build.opensuse.org/request/show/1138859 Backports:SLE-15-SP5 / perl-Spreadsheet-ParseXLSX
https://build.opensuse.org/request/show/1138860 Factory / perl-Spreadsheet-ParseXLSX
Comment 4 OBSbugzilla Bot 2024-01-15 19:35:10 UTC
This is an autogenerated message for OBS integration:
This bug (1218651) was mentioned in
https://build.opensuse.org/request/show/1139009 Factory / perl-Spreadsheet-ParseXLSX
Comment 5 Marcus Meissner 2024-01-16 11:05:31 UTC
openSUSE-SU-2024:0021-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1218651
CVE References: CVE-2024-22368
JIRA References: 
Sources used:
openSUSE Backports SLE-15-SP5 (src):    perl-Spreadsheet-ParseXLSX-0.290.0-bp155.2.3.1