From nobody Tue Mar 29 21:00:34 2022 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 2F8B91A3EE7B; Tue, 29 Mar 2022 21:00:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4KShmM0pgWz3PN5; Tue, 29 Mar 2022 21:00:35 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1648587635; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BuKiXwBpJ3b73QEj/kBvRUfXWq+jR1KcBKhE90xjJB8=; b=SER/OerylNx4nuQ1KnOIscZf8DYgKeYhZUcwt68MXmMCRKzWZP7OvEAqQjZcPIDmodhmLe U2FAZt+IlO5k145eHhrQT2GYKhJSkETIiGL/KGQixiMbBQuPbfumdi7ZI0kLAuPYJT8r4d u2etGu7cuwz87qW0FkS/cRAK/7/g2igCF0ejUCoVad6+ITawF1Wmz5mNtBk9KnrJWvAhgO Z0kdXc2W/2IfSjHbOv0wAnAqoUnmoTPveTlYp3XtpAeyQHHtGoyR9eiK1TvDYYGJRBYqQm pVSuuHWMyT7rbVshIIXe8YobG6BopWR/b7q5QUMXFL8vMw6Z9TQ9RtYQL7yqTA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id F0E1A25BA9; Tue, 29 Mar 2022 21:00:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 22TL0YRJ090864; Tue, 29 Mar 2022 21:00:34 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 22TL0YYe090863; Tue, 29 Mar 2022 21:00:34 GMT (envelope-from git) Date: Tue, 29 Mar 2022 21:00:34 GMT Message-Id: <202203292100.22TL0YYe090863@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Florian Smeets Subject: git: 36060fbbb19c - main - security/vuxml: Add www/gitea vulnerabilities List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-all@freebsd.org X-BeenThere: dev-commits-ports-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: flo X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 36060fbbb19c439751045bc139fc15cb4b02a231 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1648587635; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BuKiXwBpJ3b73QEj/kBvRUfXWq+jR1KcBKhE90xjJB8=; b=fg6nJY9XdAnWytBuI+brO1tMftvo08Wi+g7uRU8IJKRqL5WQfKytHzXIepVow0o5Yd+0Y5 OBOG0gtMNixR2f7vIvvI2X3Ta/L67wibXO5hpv9bn/PWp1DHw70Gn7i0+kJmcfDei7VMaU VZKfUNdUtjUvC15QCPJ5IyKY92Mt5m0eq3LOkHq0/L570epfNRjrpf4TbSIDyo304vVsFg Flsg5jLCeszXjpE1Ggx9+yxwcn64pDt3kTXYnJqm3aweKEUyzfi3ZeDCLo1ynQH+QliuoI ZMzQl8njCoS6sAjLWFhuWSWG9Q+NtXPf7IdDt+YXSNHcpP56NCXEd/Iv+/BjRQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1648587635; a=rsa-sha256; cv=none; b=fLISPuUksWUAxN7s3N0kr1tpDdZhjiQ8I2hAsLb8yf2cLV+Mp5hej5AHwG3bCBHHrFiFQj Ycs7hw4yGJmN9Py9VkTb8YVZ6UlyVB/Gsajb9n46B7HDGyp7TNZBk+50P41sX/99pZ+gok FUeH3wMqh0vhkbZlNnf6KL1rkDnwICSuZfGfSNJbIEyLbSkHOXh5oYimkhremIKigff4nw F7BQd6oc8DrPWBOl2vbdKn3vq3Ns9pLnI3Ltkawp6Mi4KeFbFMaZ3fFTzd7Dr70NfsgcE3 U3a7LssQfWZ30ZGBnzAy1k5wqUBiLma2Kinhe6fZHNSwU2aQbMJRmFftosd6Lw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by flo: URL: https://cgit.FreeBSD.org/ports/commit/?id=36060fbbb19c439751045bc139fc15cb4b02a231 commit 36060fbbb19c439751045bc139fc15cb4b02a231 Author: fsbruva@yahoo.com AuthorDate: 2022-03-29 20:39:43 +0000 Commit: Florian Smeets CommitDate: 2022-03-29 20:59:57 +0000 security/vuxml: Add www/gitea vulnerabilities PR: 262898 --- security/vuxml/vuln-2022.xml | 61 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 61 insertions(+) diff --git a/security/vuxml/vuln-2022.xml b/security/vuxml/vuln-2022.xml index 9dfb4792beff..22dcb8a62950 100644 --- a/security/vuxml/vuln-2022.xml +++ b/security/vuxml/vuln-2022.xml @@ -1,3 +1,64 @@ + + gitea -- Open Redirect on login + + + gitea + 1.16.5 + + + + +

Andrew Thornton reports:

+
+

+ When a location containing backslashes is presented, the existing + protections against open redirect are bypassed, because browsers + will convert adjacent forward and backslashes within the location + to double forward slashes. +

+
+ + + + CVE-2022-1058 + https://huntr.dev/bounties/4fb42144-ac70-4f76-a5e1-ef6b5e55dc0d/ + + + 2022-03-23 + 2022-03-29 + + + + + gitea -- Improper/incorrect authorization + + + gitea + 1.16.4 + + + + +

Youssef Rebahi-Gilbert reports:

+
+

+ When Gitea is built and configured for PAM authentication + it skips checking authorization completely. Therefore expired + accounts and accounts with expired passwords can still login. +

+
+ + + + CVE-2022-0905 + https://huntr.dev/bounties/8d221f92-b2b1-4878-bc31-66ff272e5ceb + + + 2022-03-06 + 2022-03-29 + + + chromium -- multiple vulnerabilities