CVE-2024-22368

The Spreadsheet::ParseXLSX package before 0.28 for Perl can encounter an out-of-memory condition during parsing of a crafted XLSX document. This occurs because the memoize implementation does not have appropriate constraints on merged cells.

This update for perl-Spreadsheet-ParseXLSX fixes the following issues:

Updated to 0.29:

see /usr/share/doc/packages/perl-Spreadsheet-ParseXLSX/Changes

0.29:

• Fix for 'Argument '' isn't numeric in addition (+) at /usr/local/shar…
• Incorrect cell values due to phonetic data doy#72
• Fix die message in parse()
• Cannot open password protected SHA1 encrypted files. doy#68
• use date format detection based on Spreadsheet::XLSX
• Add rudimentary support for hyperlinks in cells

0.28:

• CVE-2024-22368: out-of-memory condition during parsing of a crafted XLSX document (boo#1218651)

• Fix possible memory bomb as reported in https://github.com/haile01/perl_spreadsheet_excel_rce_poc/blob/main/parse_xlsx_bomb.md

• Updated Dist::Zilla configuration fixing deprecation warnings

These are all security issues fixed in the perl-Spreadsheet-ParseXLSX-0.290.0-2.1 package on the GA media of openSUSE Tumbleweed.

Le Dinh Hai discovered that Spreadsheet::ParseXLSX did not properly manage memory during cell merge operations. An attacker could possibly use this issue to consume large amounts of memory, resulting in a denial of service condition. (CVE-2024-22368)

An Pham discovered that Spreadsheet::ParseXLSX allowed the processing of external entities in a default configuration. An attacker could possibly use this vulnerability to execute an XML External Entity (XXE) injection attack. (CVE-2024-23525)