Date: Wed, 27 Sep 2023 11:04:42 GMT From: Fernando =?utf-8?Q?Apestegu=C3=ADa?= <fernape@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: 633698c493c7 - main - security/vuxml: Record net/routinator vulnerability Message-ID: <202309271104.38RB4gfV042455@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by fernape: URL: https://cgit.FreeBSD.org/ports/commit/?id=633698c493c70350263613dea0db2d7e00f9adbe commit 633698c493c70350263613dea0db2d7e00f9adbe Author: Fernando Apesteguía <fernape@FreeBSD.org> AuthorDate: 2023-09-27 11:02:36 +0000 Commit: Fernando Apesteguía <fernape@FreeBSD.org> CommitDate: 2023-09-27 11:02:36 +0000 security/vuxml: Record net/routinator vulnerability CVE-2023-39916 Base Score: 6.5 MEDIUM Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N PR: 274105 --- security/vuxml/vuln/2023.xml | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml index a49e84e5e057..063bcd934e87 100644 --- a/security/vuxml/vuln/2023.xml +++ b/security/vuxml/vuln/2023.xml @@ -1,3 +1,36 @@ + <vuln vid="ea9d1fd2-5d24-11ee-8507-b42e991fc52e"> + <topic>nlnetlabs -- Possible path traversal when storing RRDP responses</topic> + <affects> + <package> + <name>nlnetlabs</name> + <range><ge>0.9.0</ge><lt>0.12.2</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>sep@nlnetlabs.nl reports:</p> + <blockquote cite="https://nlnetlabs.nl/downloads/routinator/CVE-2023-39916.txt">; + <p>NLnet Labs Routinator 0.9.0 up to and including 0.12.1 contains a + possible path traversal vulnerability in the optional, off-by-default + keep-rrdp-responses feature that allows users to store the content + of responses received for RRDP requests. The location of these + stored responses is constructed from the URL of the request. Due + to insufficient sanitation of the URL, it is possible for an attacker + to craft a URL that results in the response being stored outside + of the directory specified for it.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2023-39916</cvename> + <url>https://nvd.nist.gov/vuln/detail/CVE-2023-39916</url>; + </references> + <dates> + <discovery>2023-09-13</discovery> + <entry>2023-09-27</entry> + </dates> + </vuln> + <vuln vid="402fccd0-5b6d-11ee-9898-00e081b7aa2d"> <topic>jenkins -- multiple vulnerabilities</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202309271104.38RB4gfV042455>