Date: Sun, 15 May 2022 12:37:17 GMT From: Dmitri Goutnik <dmgk@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: dfea246bbc8d - main - security/vuxml: Document Go vulnerability Message-ID: <202205151237.24FCbHdA023792@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by dmgk: URL: https://cgit.FreeBSD.org/ports/commit/?id=dfea246bbc8dc5bdec8054bd449e3965880afff6 commit dfea246bbc8dc5bdec8054bd449e3965880afff6 Author: Dmitri Goutnik <dmgk@FreeBSD.org> AuthorDate: 2022-05-15 12:22:05 +0000 Commit: Dmitri Goutnik <dmgk@FreeBSD.org> CommitDate: 2022-05-15 12:31:43 +0000 security/vuxml: Document Go vulnerability While here, fix package names for the previous Go entry (we also have go117 now). --- security/vuxml/vuln-2022.xml | 38 +++++++++++++++++++++++++++++++++++++- 1 file changed, 37 insertions(+), 1 deletion(-) diff --git a/security/vuxml/vuln-2022.xml b/security/vuxml/vuln-2022.xml index fe08c657ce81..9ca328997ba8 100644 --- a/security/vuxml/vuln-2022.xml +++ b/security/vuxml/vuln-2022.xml @@ -1,3 +1,36 @@ + <vuln vid="a1360138-d446-11ec-8ea1-10c37b4ac2ea"> + <topic>go -- syscall.Faccessat checks wrong group on Linux</topic> + <affects> + <package> + <name>go</name> + <range><lt>1.18.2,1</lt></range> + </package> + <package> + <name>go117</name> + <range><lt>1.17.10,1</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>The Go project reports:</p> + <blockquote cite="https://github.com/golang/go/issues/52313">; + <p>When called with a non-zero flags parameter, the + syscall.Faccessat function could incorrectly report that a + file is accessible. This bug only occurs on Linux systems.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2022-29526</cvename> + <url>https://github.com/golang/go/issues/52313</url>; + <url>https://groups.google.com/g/golang-dev/c/CPU3TB6d4oY</url>; + </references> + <dates> + <discovery>2022-04-12</discovery> + <entry>2022-05-15</entry> + </dates> + </vuln> + <vuln vid="11e36890-d28c-11ec-a06f-d4c9ef517024"> <topic>curl -- Multiple vulnerabilities</topic> <affects> @@ -321,8 +354,11 @@ <affects> <package> <name>go</name> + <range><lt>1.18.1,1</lt></range> + </package> + <package> + <name>go117</name> <range><lt>1.17.9,1</lt></range> - <range><ge>1.18,1</ge><lt>1.18.1,1</lt></range> </package> </affects> <description>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202205151237.24FCbHdA023792>