From nobody Thu Dec 2 13:58:54 2021 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id CD92B18B8D87; Thu, 2 Dec 2021 13:58:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4J4cxp48Ctz4mrH; Thu, 2 Dec 2021 13:58:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 66E871E6D8; Thu, 2 Dec 2021 13:58:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 1B2DwsPp081156; Thu, 2 Dec 2021 13:58:54 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 1B2Dwsq9081155; Thu, 2 Dec 2021 13:58:54 GMT (envelope-from git) Date: Thu, 2 Dec 2021 13:58:54 GMT Message-Id: <202112021358.1B2Dwsq9081155@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Bernard Spil Subject: git: 30e0367d305e - main - security/vuxml: Record NSS vulnerability List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-main@freebsd.org X-BeenThere: dev-commits-ports-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: brnrd X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 30e0367d305e770dd0d89a8e2c917470271a5167 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1638453534; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=hWDgRihJ6ITsj6LD+QD8pMDMXkFSMh4gTg9FemWnoXs=; b=f+2z4jf73zubxhP8rkejec9GZRTX/mVJwTHSRHcLuDLJ2a1QDhvqpSzhci27DEn+3WPGNw VTYlJS3x1SpdfeueTSy6s8Qg0JWSkUkzZVDxdQDsVYtH0O1YlQRSyAtqd0iH4cE907yUkT FMuDNTmToLMjxY2lW8ue+oYufXYWMiI3/2gsM6uU1qaLUFXV6Z5jKO3/h6X+MMa1vm1Lti WcDciQCJUCowSjtFSFysa/0+m+HRWKjl8kviAW5jOBNa+lFQckyRkgLMYhOsiao1z/6GCn H2RsFH9O3GnlufTto20WJ38wCrBkkNq8Va8k+5l3EkcZe/xjNC3ryzIvjtt4hQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1638453534; a=rsa-sha256; cv=none; b=qff35L1SWO9/441MTqGq4z/N7OjV9i5e2Q5ii5bLOBuYuund3xWHRxnNyGpg+THrVBEKhR 589YId3g5gbnoahnjCBfMPvBC44THfhIWNd/noGhz3jCaNSPFyM0bQGgifA/JgnzUoLz7O JOAtN7layTY3y2ZtbzlkH+zpUNbvo9z8yWZvfRAQitbHa6dVmLum+C1KU5bn/+oh1XCALS GnNC/RahDhOQsuOo95fM4M3lQgJ2NrmZwlEyxR4w5n/OrSpDN9d/NBc/mdd3MPOdHN7jkG E5ArAabpEANvnArKR7eIe5F3NNnCsZaxFCQx5symp7fwyfBp4L0/y17hmEogJg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by brnrd: URL: https://cgit.FreeBSD.org/ports/commit/?id=30e0367d305e770dd0d89a8e2c917470271a5167 commit 30e0367d305e770dd0d89a8e2c917470271a5167 Author: Bernard Spil AuthorDate: 2021-12-02 13:58:50 +0000 Commit: Bernard Spil CommitDate: 2021-12-02 13:58:50 +0000 security/vuxml: Record NSS vulnerability --- security/vuxml/vuln-2021.xml | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/security/vuxml/vuln-2021.xml b/security/vuxml/vuln-2021.xml index 5eff6e567470..21a5edac66a7 100644 --- a/security/vuxml/vuln-2021.xml +++ b/security/vuxml/vuln-2021.xml @@ -1,3 +1,36 @@ + + NSS -- Memory corruption + + + nss + 3.73 + + + + +

The Mozilla project reports:

+
+

Memory corruption in NSS via DER-encoded DSA and RSA-PSS signatures (Critical)

+

NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR + are vulnerable to a heap overflow when handling DER-encoded DSA or + RSA-PSS signatures. Applications using NSS for handling signatures + encoded within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be + impacted. Applications using NSS for certificate validation or other + TLS, X.509, OCSP or CRL functionality may be impacted, depending on + how they configure NSS.

+
+ + + + CVE-2021-43527 + https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/ + + + 2021-12-01 + 2021-12-02 + + + mailman < 2.1.38 -- CSRF vulnerability of list mod or member against list admin page