Date: Fri, 23 Jun 2023 09:29:15 GMT From: Eugene Grosbein <eugen@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: 11842bbbd942 - main - security/vuxml: another correction for devel/py-setuptools* Message-ID: <202306230929.35N9TFDo077485@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by eugen: URL: https://cgit.FreeBSD.org/ports/commit/?id=11842bbbd9424891c951239431ef1e4bd5e9b789 commit 11842bbbd9424891c951239431ef1e4bd5e9b789 Author: Eugene Grosbein <eugen@FreeBSD.org> AuthorDate: 2023-06-23 09:27:00 +0000 Commit: Eugene Grosbein <eugen@FreeBSD.org> CommitDate: 2023-06-23 09:29:09 +0000 security/vuxml: another correction for devel/py-setuptools* This time is covers two other records additionally. Reported-by: leres --- security/vuxml/vuln/2023.xml | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml index cd13f7023658..30e22f2f78f0 100644 --- a/security/vuxml/vuln/2023.xml +++ b/security/vuxml/vuln/2023.xml @@ -2833,7 +2833,7 @@ <affects> <package> <name>py39-setuptools</name> - <range><lt>44.1.1</lt></range> + <range><lt>44.1.1_1</lt></range> <range><ge>57.0.0</ge><lt>58.5.3_3</lt></range> <range><ge>62.1.0</ge><lt>63.1.0_1</lt></range> </package> @@ -2863,7 +2863,9 @@ <affects> <package> <name>py27-setuptools44</name> - <range><lt>65.5.1</lt></range> + <range><lt>44.1.1_1</lt></range> + <range><ge>57.0.0</ge><lt>58.5.3_3</lt></range> + <range><ge>62.1.0</ge><lt>63.1.0_1</lt></range> </package> </affects> <description> @@ -2872,7 +2874,7 @@ <blockquote cite="https://osv.dev/vulnerability/GHSA-r9hx-vwmv-q579">; <p>Python Packaging Authority (PyPA)'s setuptools is a library designed to facilitate packaging Python projects.</p> <p>Setuptools version 65.5.0 and earlier could allow remote attackers to cause a denial of service by fetching malicious HTML from a PyPI package or custom PackageIndex page due to a vulnerable Regular Expression in `package_index`.</p> - <p>This has been patched in version 65.5.1.</p> + <p>This has been patched in version 65.5.1. The patch backported to the revision 44.1.1_1.</p> </blockquote> </body> </description> @@ -2891,7 +2893,9 @@ <affects> <package> <name>py39-setuptools58</name> - <range><lt>65.5.1</lt></range> + <range><lt>44.1.1_1</lt></range> + <range><ge>57.0.0</ge><lt>58.5.3_3</lt></range> + <range><ge>62.1.0</ge><lt>63.1.0_1</lt></range> </package> </affects> <description> @@ -2900,7 +2904,7 @@ <blockquote cite="https://osv.dev/vulnerability/GHSA-r9hx-vwmv-q579">; <p>Python Packaging Authority (PyPA)'s setuptools is a library designed to facilitate packaging Python projects.</p> <p>Setuptools version 65.5.0 and earlier could allow remote attackers to cause a denial of service by fetching malicious HTML from a PyPI package or custom PackageIndex page due to a vulnerable Regular Expression in `package_index`.</p> - <p>This has been patched in version 65.5.1.</p> + <p>This has been patched in version 65.5.1. The patch backported to the revision 58.5.3_3.</p> </blockquote> </body> </description>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202306230929.35N9TFDo077485>