From owner-svn-ports-all@freebsd.org Tue May 5 22:57:43 2020
Return-Path: <owner-svn-ports-all@freebsd.org>
Delivered-To: svn-ports-all@mailman.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
by mailman.nyi.freebsd.org (Postfix) with ESMTP id 225B12D8664;
Tue, 5 May 2020 22:57:43 +0000 (UTC)
(envelope-from mandree@FreeBSD.org)
Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org
[IPv6:2610:1c1:1:606c::19:3])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
server-signature RSA-PSS (4096 bits)
client-signature RSA-PSS (4096 bits) client-digest SHA256)
(Client CN "mxrelay.nyi.freebsd.org",
Issuer "Let's Encrypt Authority X3" (verified OK))
by mx1.freebsd.org (Postfix) with ESMTPS id 49Gw9M09r9z4fDH;
Tue, 5 May 2020 22:57:43 +0000 (UTC)
(envelope-from mandree@FreeBSD.org)
Received: from repo.freebsd.org (repo.freebsd.org
[IPv6:2610:1c1:1:6068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(Client did not present a certificate)
by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id D6D591D8AD;
Tue, 5 May 2020 22:57:42 +0000 (UTC)
(envelope-from mandree@FreeBSD.org)
Received: from repo.freebsd.org ([127.0.1.37])
by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 045MvgTD062882;
Tue, 5 May 2020 22:57:42 GMT (envelope-from mandree@FreeBSD.org)
Received: (from mandree@localhost)
by repo.freebsd.org (8.15.2/8.15.2/Submit) id 045Mvgqh062880;
Tue, 5 May 2020 22:57:42 GMT (envelope-from mandree@FreeBSD.org)
Message-Id: <202005052257.045Mvgqh062880@repo.freebsd.org>
X-Authentication-Warning: repo.freebsd.org: mandree set sender to
mandree@FreeBSD.org using -f
From: Matthias Andree <mandree@FreeBSD.org>
Date: Tue, 5 May 2020 22:57:42 +0000 (UTC)
To: ports-committers@freebsd.org, svn-ports-all@freebsd.org,
svn-ports-branches@freebsd.org
Subject: svn commit: r534109 - in branches/2020Q2/mail/mailman: . files
X-SVN-Group: ports-branches
X-SVN-Commit-Author: mandree
X-SVN-Commit-Paths: in branches/2020Q2/mail/mailman: . files
X-SVN-Commit-Revision: 534109
X-SVN-Commit-Repository: ports
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-ports-all@freebsd.org
X-Mailman-Version: 2.1.30
Precedence: list
List-Id: SVN commit messages for the ports tree <svn-ports-all.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/svn-ports-all>,
<mailto:svn-ports-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-ports-all/>
List-Post: <mailto:svn-ports-all@freebsd.org>
List-Help: <mailto:svn-ports-all-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/svn-ports-all>,
<mailto:svn-ports-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 05 May 2020 22:57:43 -0000
Author: mandree
Date: Tue May 5 22:57:42 2020
New Revision: 534109
URL: https://svnweb.freebsd.org/changeset/ports/534109
Log:
2020Q2 specific mail/mailman minimal security fix
Backporting 2.1.31 needs more consideration and more than just MFH r534101,
so forgo that and for the nonce, plug this information leak quickly with the
one-line fix by upstream, and hack additional translations to match into the
.po files with REINPLACE_CMD.
Approved by: ports-secteam@ (blanket, trivial security fix)
Security: 88760f4d-8ef7-11ea-a66d-4b2ef158be83
Added:
branches/2020Q2/mail/mailman/files/patch-0-security-88760f4d-8ef7-11ea-a66d-4b2ef158be83 (contents, props changed)
Modified:
branches/2020Q2/mail/mailman/Makefile
Modified: branches/2020Q2/mail/mailman/Makefile
==============================================================================
--- branches/2020Q2/mail/mailman/Makefile Tue May 5 22:55:43 2020 (r534108)
+++ branches/2020Q2/mail/mailman/Makefile Tue May 5 22:57:42 2020 (r534109)
@@ -3,7 +3,7 @@
PORTNAME= mailman
DISTVERSION= 2.1.30
-PORTREVISION= 0
+PORTREVISION= 3
CATEGORIES= mail
MASTER_SITES= GNU \
SF/${PORTNAME}/Mailman%202.1%20%28stable%29/${PORTVERSION} \
@@ -178,6 +178,11 @@ post-patch:
${REINPLACE_CMD} -e 's/messages//' ${WRKSRC}/Makefile.in
.endif
${MV} ${WRKSRC}/configure.in ${WRKSRC}/configure.ac # suppress warning
+ # Fix up translations for patch-0-security-88760f4d-8ef7-11ea-a66d-4b2ef158be83.
+ # Note it's not just search & replace, the pattern needs to be unedited for
+ # admin.py and edited for options.py.
+ ${REINPLACE_CMD} -Ee '/Illegal Email Address: %\(safeuser\)/,+1H;$${p;x;s/ *. %\(safeuser\)s//g;}' \
+ ${WRKSRC}/messages/*/LC_MESSAGES/mailman.po
# post-patch-HTDIG-on is to fix https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=238508
post-patch-HTDIG-on:
Added: branches/2020Q2/mail/mailman/files/patch-0-security-88760f4d-8ef7-11ea-a66d-4b2ef158be83
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ branches/2020Q2/mail/mailman/files/patch-0-security-88760f4d-8ef7-11ea-a66d-4b2ef158be83 Tue May 5 22:57:42 2020 (r534109)
@@ -0,0 +1,17 @@
+This is to fix vulnerability 88760f4d-8ef7-11ea-a66d-4b2ef158be83,
+and was provided by Mark Sapiro, the upstream maintainer.
+
+Source: https://bugs.launchpad.net/mailman/+bug/1873722
+
+--- Mailman/Cgi/options.py 2019-03-06 17:48:32 +0000
++++ Mailman/Cgi/options.py 2020-04-20 03:10:16 +0000
+@@ -173,7 +173,7 @@
+ try:
+ Utils.ValidateEmail(user)
+ except Errors.EmailAddressError:
+- doc.addError(_('Illegal Email Address: %(safeuser)s'))
++ doc.addError(_('Illegal Email Address'))
+ loginpage(mlist, doc, None, language)
+ print doc.Format()
+ return
+