From owner-freebsd-ports@freebsd.org Wed Sep 5 08:24:48 2018 Return-Path: Delivered-To: freebsd-ports@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 724B3FE7CFE for ; Wed, 5 Sep 2018 08:24:48 +0000 (UTC) (envelope-from SRS0=udNw=LT=quip.cz=000.fbsd@elsa.codelab.cz) Received: from mailman.ysv.freebsd.org (mailman.ysv.freebsd.org [IPv6:2001:1900:2254:206a::50:5]) by mx1.freebsd.org (Postfix) with ESMTP id 161EB770EB for ; Wed, 5 Sep 2018 08:24:48 +0000 (UTC) (envelope-from SRS0=udNw=LT=quip.cz=000.fbsd@elsa.codelab.cz) Received: by mailman.ysv.freebsd.org (Postfix) id CF293FE7CFB; Wed, 5 Sep 2018 08:24:47 +0000 (UTC) Delivered-To: ports@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id BDD35FE7CFA; Wed, 5 Sep 2018 08:24:47 +0000 (UTC) (envelope-from SRS0=udNw=LT=quip.cz=000.fbsd@elsa.codelab.cz) Received: from elsa.codelab.cz (elsa.codelab.cz [94.124.105.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 5DDD7770EA; Wed, 5 Sep 2018 08:24:46 +0000 (UTC) (envelope-from SRS0=udNw=LT=quip.cz=000.fbsd@elsa.codelab.cz) Received: from elsa.codelab.cz (localhost [127.0.0.1]) by elsa.codelab.cz (Postfix) with ESMTP id DDBA728422; Wed, 5 Sep 2018 10:24:38 +0200 (CEST) Received: from illbsd.quip.test (ip-86-49-16-209.net.upcbroadband.cz [86.49.16.209]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by elsa.codelab.cz (Postfix) with ESMTPSA id 11E8C28411; Wed, 5 Sep 2018 10:24:37 +0200 (CEST) Subject: fix for vuln.xml / committer needed From: Miroslav Lachman <000.fbsd@quip.cz> To: freebsd-security@freebsd.org, FreeBSD Ports References: <9787dd02-177c-e5cf-0368-10cf8aca2e6f@quip.cz> Message-ID: Date: Wed, 5 Sep 2018 10:24:36 +0200 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:52.0) Gecko/20100101 Firefox/52.0 SeaMonkey/2.49.3 MIME-Version: 1.0 In-Reply-To: <9787dd02-177c-e5cf-0368-10cf8aca2e6f@quip.cz> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Sep 2018 08:24:48 -0000 Can somebody commit this easy fix, please? It is annoying to get false alarms every day in daily security reports. https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=231054 Kind Regards Miroslav Lachman Miroslav Lachman wrote on 2018/08/31 12:24: > Miroslav Lachman wrote on 2018/08/28 00:20: >> Running pkg audit FreeBSD-10.4_11 gives me one vulnerability: >> >> # pkg audit FreeBSD-10.4_11 >> FreeBSD-10.4_11 is vulnerable: >> wpa_supplicant -- unauthenticated encrypted EAPOL-Key data >> CVE: CVE-2018-14526 >> WWW: >> https://vuxml.FreeBSD.org/freebsd/6bedc863-9fbe-11e8-945f-206a8a720317.html >> >> >> 1 problem(s) in the installed packages found. >> >> But information on the page shows it was fixed in 10.4-p10: >> >> Affected packages >> wpa_supplicant     <     2.6_2 >> FreeBSD     <=     10.4_10 >> FreeBSD     <=     11.2_1 >> >> So... was it really fixed? Is there incorrect info in VuXML database >> file or on the web page? > > As noted privately by Dan Lukes, there is wrong entry in vuln.xml - > missing < 10.4 and < 11.2 (start of the range) > > --- vuln.xml.orig     2018-08-30 03:02:57.656941000 +0200 > +++ vuln.xml          2018-08-31 12:13:53.564345000 +0200 > @@ -525,8 +525,8 @@ >        >        >         FreeBSD > -       10.4_10 > -       11.2_1 > +       10.410.4_10 > +       11.211.2_1 >        >      >      > > See PR 231054. > > Miroslav Lachman