From owner-svn-ports-branches@freebsd.org Fri Jul 24 23:16:37 2015 Return-Path: Delivered-To: svn-ports-branches@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id E877F9AA958 for ; Fri, 24 Jul 2015 23:16:36 +0000 (UTC) (envelope-from feld@feld.me) Received: from out1-smtp.messagingengine.com (out1-smtp.messagingengine.com [66.111.4.25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id AE5211E69 for ; Fri, 24 Jul 2015 23:16:36 +0000 (UTC) (envelope-from feld@feld.me) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id C5B7F20976 for ; Fri, 24 Jul 2015 19:16:34 -0400 (EDT) Received: from web3 ([10.202.2.213]) by compute1.internal (MEProxy); Fri, 24 Jul 2015 19:16:34 -0400 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=feld.me; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-sasl-enc :x-sasl-enc; s=mesmtp; bh=7Jc0vab551keYNmt6t2XcZLAblc=; b=JxDdi0 eyfQDqmzo/OZaI+AT6GTPSq3vr1PTfN2Ts/dQxkRnbpAvdipJX6MYKq3yZngle6E BYpbFykqZhg/puYlSCvP9CO298Wd+Xbz3JudfMBkzodctMjn51JyKp+jLLFwZN4x +4MgI+qxAzZBVJidHDQrAP0VU0jKycAJMkrWI= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-sasl-enc:x-sasl-enc; s=smtpout; bh=7Jc0vab551keYNm t6t2XcZLAblc=; b=PSptotncEel4IXjLMcXcUuy2inGdF6+7+CBLBCsgBTwiIFz ONPQVMpyghXwLry/1MTHKl1dJjHHlzxWxhw5EhPNGbimHQ0+kIi7Xq0aEKgdsOqF wzXvX55v0QBMLcHqEnh6oJX7WqA2cE7bLASEcJg527f3GUj5M7lo4BEG2FDQ= Received: by web3.nyi.internal (Postfix, from userid 99) id 8896B10ECB9; Fri, 24 Jul 2015 19:16:34 -0400 (EDT) Message-Id: <1437779794.2853329.332590825.1F60B83A@webmail.messagingengine.com> X-Sasl-Enc: Q4uTwCPLbnZGIrZmsWbiPHNzZb71LPKUF34QmK0j6GaC 1437779794 From: Mark Felder To: Palle Girgensohn Cc: Brad Davis , ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-branches@freebsd.org MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain X-Mailer: MessagingEngine.com Webmail Interface - ajax-63a5d8c6 Subject: Re: svn commit: r392739 - branches/2015Q2/security/vuxml Date: Fri, 24 Jul 2015 18:16:34 -0500 In-Reply-To: <9A468FE8-4FB1-4781-B21E-D16444233D80@FreeBSD.org> References: <201507231624.t6NGOPAZ039747@repo.freebsd.org> <20150724162312.GO94853@valentine.liquidneon.com> <1437756844.2148972.332341833.7702303E@webmail.messagingengine.com> <9A468FE8-4FB1-4781-B21E-D16444233D80@FreeBSD.org> X-BeenThere: svn-ports-branches@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: SVN commit messages for all the branches of the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2015 23:16:37 -0000 On Fri, Jul 24, 2015, at 16:38, Palle Girgensohn wrote: > > > 24 jul 2015 kl. 18:54 skrev Mark Felder : > > > > > > > > On Fri, Jul 24, 2015, at 11:23, Brad Davis wrote: > >> On Thu, Jul 23, 2015 at 04:24:25PM +0000, Palle Girgensohn wrote: > >>> Author: girgen > >>> Date: Thu Jul 23 16:24:25 2015 > >>> New Revision: 392739 > >>> URL: https://svnweb.freebsd.org/changeset/ports/392739 > >>> > >>> Log: > >>> Shibboleth SP software crashes on well-formed but invalid XML. > >>> > >>> The Service Provider software contains a code path with an uncaught > >>> exception that can be triggered by an unauthenticated attacker by > >>> supplying well-formed but schema-invalid XML in the form of SAML > >>> metadata or SAML protocol messages. The result is a crash and so > >>> causes a denial of service. > >>> > >>> You must rebuild opensaml and shibboleth with xmltooling-1.5.5 or later. > >>> The easiest way to do so is to update the whole chain including > >>> shibboleth-2.5.5 an opensaml2.5.5. > >>> > >>> URL: http://shibboleth.net/community/advisories/secadv_20150721.txt > >>> Security: CVE-2015-2684 > >>> Approved by: ports-secteam > >>> > >>> Modified: > >>> branches/2015Q2/security/vuxml/vuln.xml > >> > >> Shouldn't this have gone into HEAD? I thought vuln.xml was only used in > >> head, not from the branches. > >> > > > > And not even the current branch... That's weird. > > > > Can we get old branches locked down a bit further? > > Umm, sorry, my mistake, I had the 2015Q2 branch checked out, and just > entierly missed it. I will merge to HEAD as I write... :-/ > That's OK, things happen. I already copied your entry to HEAD.