/ 
SOAP-Lite-0.51 UNAUTHORIZED RELEASE
Security Advisories (2)
CVE-2015-8978 (2015-07-21)

An example attack consists of defining 10 or more XML entities, each defined as consisting of 10 of the previous entity, with the document consisting of a single instance of the largest entity, which expands to one billion copies of the first entity. The amount of computer memory used for handling an external SOAP call would likely exceed that available to the process parsing the XML.

CVE-2002-1742 (2002-04-08)

Allows remote attackers to load arbitrary Perl functions by suppling a non-existent function in a script using a SOAP::Lite module, which causes the AUTOLOAD subroutine to trigger.

Changes for version 0.51 - 2001-07-18

  • ! fixed memory leak in SOAP::Parser (thanks to Ryan Adams and Michael Brown) ! fixed skipping undef elements in arrays under Perl 5.005 (thanks to Arne Georg Gleditsch) ! fixed warning from undefined type in out parameters (thanks to J†rg Ziefle) ! fixed autovivification warnings on 5.7.x (thanks to Igor Pechersky) ! fixed tests on 64bit systems (thanks to Gurusamy Sarathy) ! fixed installation problem with long filenames on MacOS (thanks to Alex Harper) ! fixed POP3 server (thanks to Kevin Hutchinson) ! number of fixes in XMLRPC::Lite fixed <string> requirement (thanks to Matthew Krenzer and Dana Powers) fixed empty slot skipping (thanks to Jon Udell) fixed serialization of "0"/""/undef values (thanks to Michael E. Gage) fixed autodispatch (thanks to Craig Kelley)
  • added support for SOAP 1.2 (spec is still in draft, implementation is subject to change)
  • added extended array support (only in deserializer) sparse arrays multidimensional arrays (deserialized as array of arrays) partially transmitted arrays
  • modified XML::Parser::Lite to work on Perl 5.005 (thanks to John Gotts) fixed handling empty attributes as undef fixed minors (thanks to Duncan Cameron)
  • modified deserializer to work with different schemas (1999/2001)
  • added JABBER transport
  • added MQ transport
  • added mod_xmlrpc transport (Apache::XMLRPC::Lite)
  • added TCP over SSL transport
  • added non-blocking TCP multiserver
  • included FCGI transport (thanks to Marko Asplund <marko.asplund@kronodoc.fi>)
  • added support for APOP authentication in POP3 transport
  • added Encoding parameter for MAILTO transport (to choose base64/binary)
  • added 'autoresult' option (thanks to Mathieu Longtin)
  • added support for import directive in WSDL
  • added support for short (tModel) WSDL service descriptions
  • added support for multiple services/ports and allowed non-SOAP bindings in WSDL
  • added full search example UDDI->WSDL->SOAP (fullsearch.pl)
  • added charset in response message for HTTP transport
  • modified SOAPsh/XMLRPCsh to return all parameters (thanks to Chris Davies)
  • modified dispatch for XMLRPC server to work exactly as for SOAP server examples included in examples/XMLRPC directory
  • added example with Inline::C module (inline.daemon). Dispatch to C, C++, assembler, Java, Python and Tcl :). Thanks to Brian Ingerson for his Inline module.
  • all transport are availble for both SOAP::Lite and XMLRPC::Lite: HTTP (daemon, CGI, mod_perl), SMTP/POP3, TCP, IO, JABBER, MQ
  • updated INCOMPATIBILITY section in README file
  • tested on Perl 5.00503, 5.6.0, 5.6.1, 5.7.1 and 5.7.2
  • added SOAP Cookbook (http://cookbook.soaplite.com/)
  • added server scripts for MQ and JABBER transports
  • added roundtrip example for JABBER transport
  • updated documentation and added new examples
  • added more tests (more than 700 for now)

Documentation

SOAPsh.pl
Interactive shell for SOAP calls
XMLRPCsh.pl
Interactive shell for XMLRPC calls

Modules

Apache::SOAP
mod_perl-based SOAP server with minimum configuration
Apache::XMLRPC::Lite
mod_perl-based XML-RPC server with minimum configuration
SOAP::Lite
Client and server side SOAP implementation
SOAP::Test
Test framework for SOAP::Lite
SOAP::Transport::FTP
Client side FTP support for SOAP::Lite
SOAP::Transport::HTTP
Server/Client side HTTP support for SOAP::Lite
SOAP::Transport::IO
Server side IO support for SOAP::Lite
SOAP::Transport::JABBER
Server/Client side JABBER support for SOAP::Lite
SOAP::Transport::LOCAL
Client side no-transport support for SOAP::Lite
SOAP::Transport::MAILTO
Client side SMTP/sendmail support for SOAP::Lite
SOAP::Transport::MQ
Server/Client side MQ support for SOAP::Lite
SOAP::Transport::POP3
Server side POP3 support for SOAP::Lite
SOAP::Transport::TCP
Server/Client side TCP support for SOAP::Lite
UDDI::Lite
Library for UDDI clients in Perl
XML::Parser::Lite
Lightweight regexp-based XML parser
XMLRPC::Lite
client and server implementation of XML-RPC protocol
XMLRPC::Test
Test framework for XMLRPC::Lite
XMLRPC::Transport::HTTP
Server/Client side HTTP support for XMLRPC::Lite
XMLRPC::Transport::POP3
Server side POP3 support for XMLRPC::Lite
XMLRPC::Transport::TCP
Server/Client side TCP support for XMLRPC::Lite

Provides

IO::SessionData
in lib/IO/SessionData.pm
IO::SessionSet
in lib/IO/SessionSet.pm
LWP::Protocol
in lib/SOAP/Transport/HTTP.pm UNAUTHORIZED
My::PingPong
in lib/SOAP/Test.pm
My::PingPong
in lib/XMLRPC/Test.pm
SOAP
in lib/SOAP/Lite.pm
SOAP::Client
in lib/SOAP/Lite.pm
SOAP::Cloneable
in lib/SOAP/Lite.pm
SOAP::Constants
in lib/SOAP/Lite.pm
SOAP::Custom::XML::Data
in lib/SOAP/Lite.pm
SOAP::Custom::XML::Deserializer
in lib/SOAP/Lite.pm
SOAP::Data
in lib/SOAP/Lite.pm
SOAP::Deserializer
in lib/SOAP/Lite.pm
SOAP::Fault
in lib/SOAP/Lite.pm
SOAP::Header
in lib/SOAP/Lite.pm
SOAP::Lite::COM
in lib/SOAP/Lite.pm
SOAP::MIMEParser
in lib/SOAP/Lite.pm
SOAP::Parser
in lib/SOAP/Lite.pm
SOAP::SOM
in lib/SOAP/Lite.pm
SOAP::Schema
in lib/SOAP/Lite.pm
SOAP::Schema::Deserializer
in lib/SOAP/Lite.pm
SOAP::Schema::WSDL
in lib/SOAP/Lite.pm
SOAP::Serializer
in lib/SOAP/Lite.pm
SOAP::Server
in lib/SOAP/Lite.pm
SOAP::Server::Object
in lib/SOAP/Lite.pm
SOAP::Server::Parameters
in lib/SOAP/Lite.pm
SOAP::Test::Server
in lib/SOAP/Test.pm
SOAP::Trace
in lib/SOAP/Lite.pm
SOAP::Transport
in lib/SOAP/Lite.pm
SOAP::Transport::FTP::Client
in lib/SOAP/Transport/FTP.pm
SOAP::Transport::HTTP::Apache
in lib/SOAP/Transport/HTTP.pm
SOAP::Transport::HTTP::CGI
in lib/SOAP/Transport/HTTP.pm
SOAP::Transport::HTTP::Client
in lib/SOAP/Transport/HTTP.pm
SOAP::Transport::HTTP::Daemon
in lib/SOAP/Transport/HTTP.pm
SOAP::Transport::HTTP::FCGI
in lib/SOAP/Transport/HTTP.pm
SOAP::Transport::HTTP::Server
in lib/SOAP/Transport/HTTP.pm
SOAP::Transport::IO::Server
in lib/SOAP/Transport/IO.pm
SOAP::Transport::JABBER::Client
in lib/SOAP/Transport/JABBER.pm
SOAP::Transport::JABBER::Query
in lib/SOAP/Transport/JABBER.pm
SOAP::Transport::JABBER::Server
in lib/SOAP/Transport/JABBER.pm
SOAP::Transport::LOCAL::Client
in lib/SOAP/Transport/LOCAL.pm
SOAP::Transport::MAILTO::Client
in lib/SOAP/Transport/MAILTO.pm
SOAP::Transport::MQ::Client
in lib/SOAP/Transport/MQ.pm
SOAP::Transport::MQ::Server
in lib/SOAP/Transport/MQ.pm
SOAP::Transport::POP3::Server
in lib/SOAP/Transport/POP3.pm
SOAP::Transport::TCP::Client
in lib/SOAP/Transport/TCP.pm
SOAP::Transport::TCP::Server
in lib/SOAP/Transport/TCP.pm
SOAP::Utils
in lib/SOAP/Lite.pm
SOAP::XMLSchema1999::Deserializer
in lib/SOAP/Lite.pm
SOAP::XMLSchema1999::Serializer
in lib/SOAP/Lite.pm
SOAP::XMLSchema2001::Deserializer
in lib/SOAP/Lite.pm
SOAP::XMLSchema2001::Serializer
in lib/SOAP/Lite.pm
SOAP::XMLSchema::Serializer
in lib/SOAP/Lite.pm
SOAP::XMLSchemaApacheSOAP::Deserializer
in lib/SOAP/Lite.pm
SOAP::XMLSchemaSOAP1_1::Deserializer
in lib/SOAP/Lite.pm
SOAP::XMLSchemaSOAP1_2::Deserializer
in lib/SOAP/Lite.pm
UDDI::Data
in lib/UDDI/Lite.pm
UDDI::Deserializer
in lib/UDDI/Lite.pm
UDDI::SOM
in lib/UDDI/Lite.pm
UDDI::Serializer
in lib/UDDI/Lite.pm
URI::jabber
in lib/SOAP/Transport/JABBER.pm
URI::mq
in lib/SOAP/Transport/MQ.pm
URI::tcp
in lib/SOAP/Transport/TCP.pm
XMLRPC
in lib/XMLRPC/Lite.pm
XMLRPC::Constants
in lib/XMLRPC/Lite.pm
XMLRPC::Data
in lib/XMLRPC/Lite.pm
XMLRPC::Deserializer
in lib/XMLRPC/Lite.pm
XMLRPC::SOM
in lib/XMLRPC/Lite.pm
XMLRPC::Serializer
in lib/XMLRPC/Lite.pm
XMLRPC::Server
in lib/XMLRPC/Lite.pm
XMLRPC::Server::Parameters
in lib/XMLRPC/Lite.pm
XMLRPC::Test::Server
in lib/XMLRPC/Test.pm
XMLRPC::Transport::HTTP::Apache
in lib/XMLRPC/Transport/HTTP.pm
XMLRPC::Transport::HTTP::CGI
in lib/XMLRPC/Transport/HTTP.pm
XMLRPC::Transport::HTTP::Daemon
in lib/XMLRPC/Transport/HTTP.pm
XMLRPC::Transport::POP3::Server
in lib/XMLRPC/Transport/POP3.pm
XMLRPC::Transport::TCP::Server
in lib/XMLRPC/Transport/TCP.pm

Examples

Other files