K08383757 : perl-XML-Twig vulnerability CVE-2016-9180

Security Advisory Description

perl-XML-Twig: The option to expand_external_ents, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option’s setting. (CVE-2016-9180)

Impact

An authenticated user with a BIG-IP ASM administrative role, such as Policy Editor, may be able to craft an XML message which, when processed by the ASMConfig process usingperl-XML-Twig, may cause a denial of service (DoS) or potentially an information disclosure.