Date: Thu, 1 Dec 2022 14:14:43 GMT From: Rodrigo Osorio <rodrigo@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: bfee83e3a0be - main - security/vuxml: Record rpm4 vulnerability. Message-ID: <202212011414.2B1EEhKM064954@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by rodrigo: URL: https://cgit.FreeBSD.org/ports/commit/?id=bfee83e3a0be489b8e54d647ca4d1add4cf5c9be commit bfee83e3a0be489b8e54d647ca4d1add4cf5c9be Author: Rodrigo Osorio <rodrigo@FreeBSD.org> AuthorDate: 2022-12-01 13:39:16 +0000 Commit: Rodrigo Osorio <rodrigo@FreeBSD.org> CommitDate: 2022-12-01 14:03:36 +0000 security/vuxml: Record rpm4 vulnerability. Add multiple CVE fixed in latest rpm4 version. PR: 267291 --- security/vuxml/vuln/2022.xml | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/security/vuxml/vuln/2022.xml b/security/vuxml/vuln/2022.xml index 4c9d6d9874e1..67c3a41de84f 100644 --- a/security/vuxml/vuln/2022.xml +++ b/security/vuxml/vuln/2022.xml @@ -1,3 +1,32 @@ + <vuln vid="0c52abde-717b-11ed-98ca-40b034429ecf"> + <topic>rpm4 -- Multiple Vulnerabilities</topic> + <affects> + <package> + <name>rpm4</name> + <range><lt>4.18.0</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>rpm project reports:</p> + <blockquote cite="https://rpm.org/wiki/Releases/4.18.0">; + <p>Fix intermediate symlinks not verified (CVE-2021-35939).</p> + <p>Fix subkey binding signatures not checked on PGP public keys (CVE-2021-3521).</p> + <p>Refactor file and directory operations to use fd-based APIs throughout (CVE-2021-35938)</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2021-35939</cvename> + <cvename>CVE-2021-3521</cvename> + <cvename>CVE-2021-35938</cvename> + </references> + <dates> + <discovery>2022-08-22</discovery> + <entry>2022-12-01</entry> + </dates> + </vuln> + <vuln vid="3cde510a-7135-11ed-a28b-bff032704f00"> <topic>Gitlab -- Multiple Vulnerabilities</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202212011414.2B1EEhKM064954>