From owner-svn-ports-all@FreeBSD.ORG Sat Jun 22 12:49:30 2013 Return-Path: Delivered-To: svn-ports-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id 93B3C852; Sat, 22 Jun 2013 12:49:30 +0000 (UTC) (envelope-from swills@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) by mx1.freebsd.org (Postfix) with ESMTP id 84F371CBC; Sat, 22 Jun 2013 12:49:30 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r5MCnUAE025960; Sat, 22 Jun 2013 12:49:30 GMT (envelope-from swills@svn.freebsd.org) Received: (from swills@localhost) by svn.freebsd.org (8.14.7/8.14.5/Submit) id r5MCnTPi025952; Sat, 22 Jun 2013 12:49:29 GMT (envelope-from swills@svn.freebsd.org) Message-Id: <201306221249.r5MCnTPi025952@svn.freebsd.org> From: Steve Wills Date: Sat, 22 Jun 2013 12:49:29 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r321570 - in head: security/vuxml sysutils/puppet sysutils/puppet/files sysutils/puppet27 X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 22 Jun 2013 12:49:30 -0000 Author: swills Date: Sat Jun 22 12:49:28 2013 New Revision: 321570 URL: http://svnweb.freebsd.org/changeset/ports/321570 Log: - Update puppet to 3.2.2 which fixes CVE-2013-3567 [1] - Update puppet27 to 2.7.22 which fixes CVE-2013-3567 - Document security issue PR: ports/179816 [1] Submitted by: mat [1] Security: b162b218-c547-4ba2-ae31-6fdcb61bc763 Deleted: head/sysutils/puppet/files/patch-service-freebsd.rb Modified: head/security/vuxml/vuln.xml head/sysutils/puppet/Makefile head/sysutils/puppet/distinfo head/sysutils/puppet27/Makefile head/sysutils/puppet27/distinfo Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sat Jun 22 12:18:39 2013 (r321569) +++ head/security/vuxml/vuln.xml Sat Jun 22 12:49:28 2013 (r321570) @@ -51,6 +51,41 @@ Note: Please add new entries to the beg --> + + puppet -- Unauthenticated Remote Code Execution Vulnerability + + + puppet + 3.2.2 + + + puppet27 + 2.72.7.22 + + + + +

Puppet Developers report:

+
When making REST api calls, the puppet master takes YAML from an + untrusted client, deserializes it, and then calls methods on the + resulting object. A YAML payload can be crafted to cause the + deserialization to construct an instance of any class available in + the ruby process, which allows an attacker to execute code + contained in the payload. +
+

+ + + + CVE-2013-3567 + + + 2013-06-13 + 2013-06-22 + + + otrs -- information disclosure Modified: head/sysutils/puppet/Makefile ============================================================================== --- head/sysutils/puppet/Makefile Sat Jun 22 12:18:39 2013 (r321569) +++ head/sysutils/puppet/Makefile Sat Jun 22 12:49:28 2013 (r321570) @@ -2,8 +2,7 @@ # $FreeBSD$ PORTNAME= puppet -PORTVERSION= 3.1.1 -PORTREVISION= 2 +PORTVERSION= 3.2.2 CATEGORIES= sysutils MASTER_SITES= http://downloads.puppetlabs.com/puppet/ @@ -41,11 +40,14 @@ MAN8= extlookup2hiera.8 puppet-agent.8 p puppet-resource_type.8 puppet-secret_agent.8 puppet-status.8 \ puppet.8 -OPTIONS_DEFINE= MONGREL PACKAGE_ORIGIN PACKAGE_ROOT +OPTIONS_DEFINE= MONGREL OPTIONS_DEFAULT= PACKAGE_ORIGIN +OPTIONS_SINGLE= PATCHES +OPTIONS_SINGLE_PATCHES= PACKAGE_ORIGIN PACKAGE_ROOT MONGREL_DESC= Run puppet server as a mongrel service PACKAGE_ORIGIN_DESC= Use port origin as package name PACKAGE_ROOT_DESC= Use PACKAGEROOT insted of PACKAGESITE +PATCHES_DESC= Optional exclusive patches .include Modified: head/sysutils/puppet/distinfo ============================================================================== --- head/sysutils/puppet/distinfo Sat Jun 22 12:18:39 2013 (r321569) +++ head/sysutils/puppet/distinfo Sat Jun 22 12:49:28 2013 (r321570) @@ -1,2 +1,2 @@ -SHA256 (puppet-3.1.1.tar.gz) = 4401f6388bb96b1301a107f247af6fa558127d78467bb5cef1a1e0ff66b4463d -SIZE (puppet-3.1.1.tar.gz) = 1587190 +SHA256 (puppet-3.2.2.tar.gz) = c47745aa73912b2cb1a20b07e8741b8af37a920b9bc8dc8afb14b23d8df7d13d +SIZE (puppet-3.2.2.tar.gz) = 1784340 Modified: head/sysutils/puppet27/Makefile ============================================================================== --- head/sysutils/puppet27/Makefile Sat Jun 22 12:18:39 2013 (r321569) +++ head/sysutils/puppet27/Makefile Sat Jun 22 12:49:28 2013 (r321570) @@ -2,8 +2,7 @@ # $FreeBSD$ PORTNAME= puppet -PORTVERSION= 2.7.21 -PORTREVISION= 1 +PORTVERSION= 2.7.22 CATEGORIES= sysutils MASTER_SITES= http://downloads.puppetlabs.com/puppet/ @@ -43,11 +42,14 @@ MAN8= filebucket.8 pi.8 puppet-agent.8 p puppet.8 puppetca.8 puppetd.8 puppetdoc.8 puppetmasterd.8 \ puppetqd.8 puppetrun.8 ralsh.8 -OPTIONS_DEFINE= MONGREL PACKAGE_ORIGIN PACKAGE_ROOT +OPTIONS_DEFINE= MONGREL OPTIONS_DEFAULT= PACKAGE_ORIGIN +OPTIONS_SINGLE= PATCHES +OPTIONS_SINGLE_PATCHES= PACKAGE_ORIGIN PACKAGE_ROOT MONGREL_DESC= Run puppet server as a mongrel service PACKAGE_ORIGIN_DESC= Use port origin as package name PACKAGE_ROOT_DESC= Use PACKAGEROOT insted of PACKAGESITE +PATCHES_DESC= Optional exclusive patches .include Modified: head/sysutils/puppet27/distinfo ============================================================================== --- head/sysutils/puppet27/distinfo Sat Jun 22 12:18:39 2013 (r321569) +++ head/sysutils/puppet27/distinfo Sat Jun 22 12:49:28 2013 (r321570) @@ -1,2 +1,2 @@ -SHA256 (puppet-2.7.21.tar.gz) = c18b426457d023e87745f0a98b7dd257f8e94722b5b0d3cafb6048ef2499273f -SIZE (puppet-2.7.21.tar.gz) = 1998848 +SHA256 (puppet-2.7.22.tar.gz) = bfd79c0aecdeea4e1a8573e9325fbcb48778603d908180e88897458f01fe06de +SIZE (puppet-2.7.22.tar.gz) = 2023230