From owner-svn-ports-all@freebsd.org Tue May 5 22:57:43 2020 Return-Path: Delivered-To: svn-ports-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 225B12D8664; Tue, 5 May 2020 22:57:43 +0000 (UTC) (envelope-from mandree@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 49Gw9M09r9z4fDH; Tue, 5 May 2020 22:57:43 +0000 (UTC) (envelope-from mandree@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id D6D591D8AD; Tue, 5 May 2020 22:57:42 +0000 (UTC) (envelope-from mandree@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 045MvgTD062882; Tue, 5 May 2020 22:57:42 GMT (envelope-from mandree@FreeBSD.org) Received: (from mandree@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 045Mvgqh062880; Tue, 5 May 2020 22:57:42 GMT (envelope-from mandree@FreeBSD.org) Message-Id: <202005052257.045Mvgqh062880@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: mandree set sender to mandree@FreeBSD.org using -f From: Matthias Andree Date: Tue, 5 May 2020 22:57:42 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-branches@freebsd.org Subject: svn commit: r534109 - in branches/2020Q2/mail/mailman: . files X-SVN-Group: ports-branches X-SVN-Commit-Author: mandree X-SVN-Commit-Paths: in branches/2020Q2/mail/mailman: . files X-SVN-Commit-Revision: 534109 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 May 2020 22:57:43 -0000 Author: mandree Date: Tue May 5 22:57:42 2020 New Revision: 534109 URL: https://svnweb.freebsd.org/changeset/ports/534109 Log: 2020Q2 specific mail/mailman minimal security fix Backporting 2.1.31 needs more consideration and more than just MFH r534101, so forgo that and for the nonce, plug this information leak quickly with the one-line fix by upstream, and hack additional translations to match into the .po files with REINPLACE_CMD. Approved by: ports-secteam@ (blanket, trivial security fix) Security: 88760f4d-8ef7-11ea-a66d-4b2ef158be83 Added: branches/2020Q2/mail/mailman/files/patch-0-security-88760f4d-8ef7-11ea-a66d-4b2ef158be83 (contents, props changed) Modified: branches/2020Q2/mail/mailman/Makefile Modified: branches/2020Q2/mail/mailman/Makefile ============================================================================== --- branches/2020Q2/mail/mailman/Makefile Tue May 5 22:55:43 2020 (r534108) +++ branches/2020Q2/mail/mailman/Makefile Tue May 5 22:57:42 2020 (r534109) @@ -3,7 +3,7 @@ PORTNAME= mailman DISTVERSION= 2.1.30 -PORTREVISION= 0 +PORTREVISION= 3 CATEGORIES= mail MASTER_SITES= GNU \ SF/${PORTNAME}/Mailman%202.1%20%28stable%29/${PORTVERSION} \ @@ -178,6 +178,11 @@ post-patch: ${REINPLACE_CMD} -e 's/messages//' ${WRKSRC}/Makefile.in .endif ${MV} ${WRKSRC}/configure.in ${WRKSRC}/configure.ac # suppress warning + # Fix up translations for patch-0-security-88760f4d-8ef7-11ea-a66d-4b2ef158be83. + # Note it's not just search & replace, the pattern needs to be unedited for + # admin.py and edited for options.py. + ${REINPLACE_CMD} -Ee '/Illegal Email Address: %\(safeuser\)/,+1H;$${p;x;s/ *. %\(safeuser\)s//g;}' \ + ${WRKSRC}/messages/*/LC_MESSAGES/mailman.po # post-patch-HTDIG-on is to fix https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=238508 post-patch-HTDIG-on: Added: branches/2020Q2/mail/mailman/files/patch-0-security-88760f4d-8ef7-11ea-a66d-4b2ef158be83 ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ branches/2020Q2/mail/mailman/files/patch-0-security-88760f4d-8ef7-11ea-a66d-4b2ef158be83 Tue May 5 22:57:42 2020 (r534109) @@ -0,0 +1,17 @@ +This is to fix vulnerability 88760f4d-8ef7-11ea-a66d-4b2ef158be83, +and was provided by Mark Sapiro, the upstream maintainer. + +Source: https://bugs.launchpad.net/mailman/+bug/1873722 + +--- Mailman/Cgi/options.py 2019-03-06 17:48:32 +0000 ++++ Mailman/Cgi/options.py 2020-04-20 03:10:16 +0000 +@@ -173,7 +173,7 @@ + try: + Utils.ValidateEmail(user) + except Errors.EmailAddressError: +- doc.addError(_('Illegal Email Address: %(safeuser)s')) ++ doc.addError(_('Illegal Email Address')) + loginpage(mlist, doc, None, language) + print doc.Format() + return +