From owner-freebsd-python@FreeBSD.ORG Mon Mar 3 07:05:37 2014 Return-Path: Delivered-To: freebsd-python@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id E4AA3641 for ; Mon, 3 Mar 2014 07:05:36 +0000 (UTC) Received: from mail-ie0-x244.google.com (mail-ie0-x244.google.com [IPv6:2607:f8b0:4001:c03::244]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id B6B2F165 for ; Mon, 3 Mar 2014 07:05:36 +0000 (UTC) Received: by mail-ie0-f196.google.com with SMTP id rd18so3018278iec.11 for ; Sun, 02 Mar 2014 23:05:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=//CupOkcU9P3+4+IpHtrHOyeCGNv76Y8dMe3sVxcDbY=; b=i3kLALRKBx/qaJla5Byr5pT/m2THirLOJsWub4gQiDh4H9ZC8Lw14fYX2Jh3Q/MrcS RosQrDxeJrA17EUu3n6eyNIc9KPBlNMj1Ul4TgBxaLDoSPfzmq/W9T1nT2apGvBWcxoO FVxBgNlrmn++LmK9qWKOSn8wPm6UCrGKHeiUlrv6ZpIIS5Z3RMSoJ/mB/Hwow8eXAWS5 Ma7WjUitxhJpaBY3PhfZ32NSKN352fgM/wgp9ScX+cmIwJBSzaNiNuyMidZp4KqQszNt +xkYp2buQbHRNu88SGgZUo32VmScSxFvpEqtmbcwYzMvDjQWxV1YNbgGvFJrto13CPmn iipQ== MIME-Version: 1.0 X-Received: by 10.50.4.74 with SMTP id i10mr19851919igi.43.1393830336114; Sun, 02 Mar 2014 23:05:36 -0800 (PST) Received: by 10.42.159.132 with HTTP; Sun, 2 Mar 2014 23:05:36 -0800 (PST) Date: Mon, 3 Mar 2014 01:05:36 -0600 Message-ID: Subject: pyhon33 still listed as vulnerable From: JEREMY COX To: freebsd-python@freebsd.org Content-Type: text/plain; charset=ISO-8859-1 X-Content-Filtered-By: Mailman/MimeDel 2.1.17 X-BeenThere: freebsd-python@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: FreeBSD-specific Python issues List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Mar 2014 07:05:37 -0000 Hello all, I was having difficulty updating python33 today, even though the vulnerability to python 3.3.3_2 (CVE-2014-1912) was patched. After verifying with Freshports python 3.3.3_3 was correct, I used *portmaster -m DISABLE_VULNERABILITIES=yes python33* to update the port. However, pkg audit is still complaining the port is vulnerable: *root@riotskates:/ # pkg auditpython33-3.3.3_3 is vulnerable:Python -- buffer overflow in socket.recvfrom_into()CVE: CVE-2014-1912WWW: http://portaudit.FreeBSD.org/8e5e6d42-a0fa-11e3-b09a-080027f2d077.html 1 problem(s) in the installed packages found.* I'm not familiar with inconsistencies found between the ports tree (which is obviously correct) and portaudit.FreeBSD.org (I've actually never seen this problem before). Is there something I need to update to fix this on my machine or will this be caught upstream sometime later on? N.B. BTW I updated python27 with no problems at all. Thank you for your time, Jeremy