From nobody Tue Mar 10 18:01:41 2026 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4fVhXW5tnCz6TnNQ for ; Tue, 10 Mar 2026 18:01:47 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4fVhXW1n4Jz3tw6 for ; Tue, 10 Mar 2026 18:01:47 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1773165707; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=8ehlcC/X2kzV0cJjRNtrw2R+cnGlwMbHYR0v1ga5cBI=; b=PQBu7R7cUVB0ZYqCkF1bdMh+Eaz5q1htuYnDDPRLyB+L/bq7ONnexWBU63rm41pm1SMj67 KJoZrbaFgvV3icjTyfA2QFXs4XvpuKjhT6pwuy7O461BZXqpU9lt8DvTixkCIuXQus2U+h AhnJAg1hok5j4Z87IlBTwo5Yz2QqGRUWv8UM5Fa/oXmPzDqNTqq6jhkvAPMDX60qJz0xNi ADRs9C4m4dZ0rlacrEnqn6OHLj7d/UsdYFQ5wq0HLHlSJtqZJItd2lNxyjkH7sYvhYQsJE kXxDYX0ACvWE7UVu3GzZVjmqwHkrmzoJB0QWUTqrlB5DAIoci5JA2Cx0nUAyFg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1773165707; a=rsa-sha256; cv=none; b=OZ4hkt4nnC1NS63X+iSv4+gPkBGr/X4zKYDdPxUYQPsWK0LTzEN4F5yfq9YIRL0YmanbKq RxfZ01bLurhsiJogHcfaWAvMvbwiYqYGHIcetqrAzKUp91i6SSNS+pXMrxT/pBQ/1VCJL4 i2ZgjE46AfT+UL0AGiaSbyDKRTZiWyzZsSK6+XiKsWPJn/+iI/Xo2aomLzXiWUXmmd2ufO y+Oj+buQsXmGfwnUXjKA6Arheq8SJ+UFUqh9HvhxFR8ZEIv7i8AbsY1ZasIOfr+2V3GuNB ULxAtd9BicaLItp51Uy9vX6fxorKKq1evnv33KSTeWIG37Am045JjLniem27iA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1773165707; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=8ehlcC/X2kzV0cJjRNtrw2R+cnGlwMbHYR0v1ga5cBI=; b=FgtNhwXX7QFFdcA7vkGbZTVQ7TQOLZqtG72FBJ91yWn4RgcWaFvKwI6XKON7iYNTYIdZIL bcNZo5AtVmYorcOH/3mDOPeTs48MIRDjmgXMl0nBlBcXtBZC1pyTGUBB1oKk147aImVIjc PRIx3GYTbdci4EsJZdvRlSy6U+R2Kylfe9miuPmWZ2NxNjWIGUFXRGeFZYqDnyW/4USKag Knil46xyp3fjuonZ8EU4F8XvfchXxfFiv8zoSXLqrGpooRGaTagGsl3DC0Oy7gEXrjUC0t 5vyjNIuzqnBL1n6GTzLy7sBI054rJB4CSaBdQRnR52rgv/YXrH+3qx3G6rppjA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4fVhXW19hXz7Kx for ; Tue, 10 Mar 2026 18:01:47 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1cf16 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 10 Mar 2026 18:01:41 +0000 To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-branches@FreeBSD.org Cc: Vidar Karlsen From: Vladimir Druzenko Subject: git: 19a9bb7e1237 - 2026Q1 - www/awstats: Remove awdownloadcsv.pl (security vuln) List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-ports-all@freebsd.org Sender: owner-dev-commits-ports-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: vvd X-Git-Repository: ports X-Git-Refname: refs/heads/2026Q1 X-Git-Reftype: branch X-Git-Commit: 19a9bb7e1237aa253c1a9988ea1e0679a5d13e10 Auto-Submitted: auto-generated Date: Tue, 10 Mar 2026 18:01:41 +0000 Message-Id: <69b05c85.1cf16.37b8d470@gitrepo.freebsd.org> The branch 2026Q1 has been updated by vvd: URL: https://cgit.FreeBSD.org/ports/commit/?id=19a9bb7e1237aa253c1a9988ea1e0679a5d13e10 commit 19a9bb7e1237aa253c1a9988ea1e0679a5d13e10 Author: Vidar Karlsen AuthorDate: 2026-03-10 17:58:29 +0000 Commit: Vladimir Druzenko CommitDate: 2026-03-10 18:01:35 +0000 www/awstats: Remove awdownloadcsv.pl (security vuln) Problem: awdownloadcsv.pl is vulnerable to command injection and path traversal, ref [1] and [2]. The GitHub issue [1] mentions that it is deprecated, and the readme does not list this file among the files that are (supposed to be) part of the distribution. Solution: This commit prevents awdownloadcsv.pl to be installed, thus removing the vulnerability. [1] https://github.com/eldy/AWStats/issues/276 [2] https://www.openwall.com/lists/oss-security/2026/03/08/8 While here, clean up sorting of IPV6_RUN_DEPENDS. PR: 293698 MFH: 2026Q1 (cherry picked from commit b029f6c828cd6a9c29f50a1ecfb9fef90ca409c4) --- www/awstats/Makefile | 7 ++++--- www/awstats/pkg-plist | 1 - 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/www/awstats/Makefile b/www/awstats/Makefile index e3d7f81a0ef4..309d88cf11ba 100644 --- a/www/awstats/Makefile +++ b/www/awstats/Makefile @@ -1,5 +1,6 @@ PORTNAME= awstats DISTVERSION= 8.0 +PORTREVISION= 1 PORTEPOCH= 1 CATEGORIES= www MASTER_SITES= SF/${PORTNAME}/AWStats/${DISTVERSION} @@ -36,8 +37,8 @@ MODULES_DESC= Plugin support not present in Perl CORE DECODEUTFKEYS_RUN_DEPENDS= p5-URI>0:net/p5-URI GEOIPFREE_RUN_DEPENDS= p5-Geo-IPfree>=0:net/p5-Geo-IPfree HOSTINFO_RUN_DEPENDS= p5-Net-XWhois>=0:net/p5-Net-XWhois -IPV6_RUN_DEPENDS= p5-Net-IP>=0:net-mgmt/p5-Net-IP \ - p5-Net-DNS>=0:dns/p5-Net-DNS +IPV6_RUN_DEPENDS= p5-Net-DNS>=0:dns/p5-Net-DNS \ + p5-Net-IP>=0:net-mgmt/p5-Net-IP JSON_RUN_DEPENDS= p5-JSON-XS>=0:converters/p5-JSON-XS \ p5-Try-Tiny>=0:lang/p5-Try-Tiny @@ -45,7 +46,7 @@ _DOCS= dolibarr httpd_conf nginx webmin _TOOLS= awstats_buildstaticpages.pl awstats_configure.pl \ awstats_exportlib.pl awstats_updateall.pl geoip_generator.pl \ logresolvemerge.pl maillogconvert.pl urlaliasbuilder.pl -_CGI_BIN= awdownloadcsv.pl awredir.pl awstats.model.conf awstats.pl +_CGI_BIN= awredir.pl awstats.model.conf awstats.pl _SHARE_DIRS= lang lib plugins _WWW_DIRS= css icon js diff --git a/www/awstats/pkg-plist b/www/awstats/pkg-plist index e72ebfb8ad99..ff61023083be 100644 --- a/www/awstats/pkg-plist +++ b/www/awstats/pkg-plist @@ -81,7 +81,6 @@ %%PORTDOCS%%%%DOCSDIR%%/webmin/.gitignore %%PORTDOCS%%%%DOCSDIR%%/webmin/README.md %%PORTDOCS%%%%DOCSDIR%%/webmin/awstats-2.0.wbm -%%WWWDIR%%/cgi-bin/awdownloadcsv.pl %%WWWDIR%%/cgi-bin/awredir.pl %%WWWDIR%%/cgi-bin/awstats.model.conf %%WWWDIR%%/cgi-bin/awstats.pl