From nobody Fri Jun 10 12:16:15 2022
X-Original-To: freebsd-security@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 5C95683E221
	for <freebsd-security@mlmmj.nyi.freebsd.org>; Fri, 10 Jun 2022 12:16:28 +0000 (UTC)
	(envelope-from ish@amail.plala.or.jp)
Received: from msc11.plala.or.jp (msc11.plala.or.jp [IPv6:2400:7800:0:502e::21])
	by mx1.freebsd.org (Postfix) with ESMTP id 4LKKgt4pdSz3qsT
	for <freebsd-security@freebsd.org>; Fri, 10 Jun 2022 12:16:26 +0000 (UTC)
	(envelope-from ish@amail.plala.or.jp)
Received: from localhost ([2400:4050:9320:7a00::8]) by msc11.plala.or.jp
          with ESMTP
          id <20220610121622.NYJX31769.msc11.plala.or.jp@localhost>
          for <freebsd-security@freebsd.org>;
          Fri, 10 Jun 2022 21:16:22 +0900
Date: Fri, 10 Jun 2022 21:16:15 +0900 (JST)
Message-Id: <20220610.211615.2181623761441101839.ish@amail.plala.or.jp>
To: freebsd-security@freebsd.org
Subject: Re: Is apache24-2.4.54 vulnerable ?
From: Masachika ISHIZUKA <ish@amail.plala.or.jp>
In-Reply-To: <ac0ffe35-d35f-1b2f-b583-06179cac5230@hyjazi.me>
References: <20220610.085155.1636577084047793852.moto@kawasaki3.org>
	<20220610.095448.1735421952196505841.ish@amail.plala.or.jp>
	<ac0ffe35-d35f-1b2f-b583-06179cac5230@hyjazi.me>
X-Mailer: Mew version 6.8 on Emacs 28.1
List-Id: Security issues <freebsd-security.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-security
List-Help: <mailto:freebsd-security+help@freebsd.org>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Subscribe: <mailto:freebsd-security+subscribe@freebsd.org>
List-Unsubscribe: <mailto:freebsd-security+unsubscribe@freebsd.org>
Sender: owner-freebsd-security@freebsd.org
X-BeenThere: freebsd-security@freebsd.org
Mime-Version: 1.0
Content-Type: Text/Plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
X-VirusScan: Outbound; mvir-ac11; Fri, 10 Jun 2022 21:16:22 +0900
X-Rspamd-Queue-Id: 4LKKgt4pdSz3qsT
X-Spamd-Bar: /
Authentication-Results: mx1.freebsd.org;
	dkim=none;
	dmarc=none;
	spf=pass (mx1.freebsd.org: domain of ish@amail.plala.or.jp designates 2400:7800:0:502e::21 as permitted sender) smtp.mailfrom=ish@amail.plala.or.jp
X-Spamd-Result: default: False [-0.62 / 15.00];
	 ARC_NA(0.00)[];
	 NEURAL_HAM_MEDIUM(-1.00)[-0.999];
	 FROM_HAS_DN(0.00)[];
	 MV_CASE(0.50)[];
	 TO_MATCH_ENVRCPT_ALL(0.00)[];
	 MIME_GOOD(-0.10)[text/plain];
	 PREVIOUSLY_DELIVERED(0.00)[freebsd-security@freebsd.org];
	 TO_DN_NONE(0.00)[];
	 RCPT_COUNT_ONE(0.00)[1];
	 NEURAL_HAM_LONG(-0.99)[-0.988];
	 DMARC_NA(0.00)[plala.or.jp];
	 R_SPF_ALLOW(-0.20)[+ip6:2400:7800:0:502e::/60];
	 NEURAL_HAM_SHORT(-0.94)[-0.935];
	 MID_CONTAINS_FROM(1.00)[];
	 MLMMJ_DEST(0.00)[freebsd-security];
	 RCVD_NO_TLS_LAST(0.10)[];
	 FROM_EQ_ENVFROM(0.00)[];
	 R_DKIM_NA(0.00)[];
	 MIME_TRACE(0.00)[0:+];
	 ASN(0.00)[asn:4713, ipnet:2400:7800::/32, country:JP];
	 SUBJECT_ENDS_QUESTION(1.00)[];
	 RCVD_COUNT_TWO(0.00)[2]
X-ThisMailContainsUnwantedMimeParts: N

> seems to be tagged so by vulnxml, but all this CVE are addressed and
> fixed=A0 by 2.4.54 (https://downloads.apache.org/httpd/CHANGES_2.4.54=
)
> =

>>>> % pkg audit -F
>>>> vulnxml file up-to-date
>>>> apache24-2.4.54 is vulnerable:
>>>>
  [snip]
>>
>> vuln-2022.xml:
>>    <affects>
>>      <package>
>>      <name>apache24</name>
>>      <range><lt>2.5.54</lt></range>   <------- 2.4.54 ???
>>      </package> ~~~~~~
>>    </affects>

  Thank you for reply.

  vulnxml was fixed by 0bb1abdb20498df239e15e7f9e9eec33e2eec499.
-- =

Masachika ISHIZUKA