From nobody Wed Jun 23 07:28:24 2021
X-Original-To: freebsd-ports@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 12E9A11CBEBB
	for <freebsd-ports@mlmmj.nyi.freebsd.org>; Wed, 23 Jun 2021 07:28:34 +0000 (UTC)
	(envelope-from pi@freebsd.org)
Received: from home.opsec.eu (home.opsec.eu [IPv6:2001:14f8:200::1])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
	(Client did not present a certificate)
	by mx1.freebsd.org (Postfix) with ESMTPS id 4G8vy97090z3R2w;
	Wed, 23 Jun 2021 07:28:33 +0000 (UTC)
	(envelope-from pi@freebsd.org)
Received: from pi by home.opsec.eu with local (Exim 4.94.2 (FreeBSD))
	(envelope-from <pi@freebsd.org>)
	id 1lvxJA-000A8r-JY; Wed, 23 Jun 2021 09:28:24 +0200
Date: Wed, 23 Jun 2021 09:28:24 +0200
From: Kurt Jaeger <pi@freebsd.org>
To: Andrea Venturoli <ml@netfence.it>
Cc: koobs@freebsd.org, freebsd-ports@freebsd.org
Subject: Re: www/py-aiohttp vulnerabilities
Message-ID: <YNLimK86kKI3693B@home.opsec.eu>
References: <3c438d98-6c84-caf1-cfe9-45bf2b0527bf@netfence.it>
List-Id: Porting software to FreeBSD <freebsd-ports.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-ports
List-Help: <mailto:ports+help@freebsd.org>
List-Post: <mailto:ports@freebsd.org>
List-Subscribe: <mailto:ports+subscribe@freebsd.org>
List-Unsubscribe: <mailto:ports+unsubscribe@freebsd.org>
Sender: owner-freebsd-ports@freebsd.org
X-BeenThere: freebsd-ports@freebsd.org
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <3c438d98-6c84-caf1-cfe9-45bf2b0527bf@netfence.it>
X-Rspamd-Queue-Id: 4G8vy97090z3R2w
X-Spamd-Bar: ----
Authentication-Results: mx1.freebsd.org;
	none
X-Spamd-Result: default: False [-4.00 / 15.00];
	 REPLY(-4.00)[]
X-ThisMailContainsUnwantedMimeParts: N

Hi!

> pkg audit complains that
> > py37-aiohttp-3.7.4.p0 (www/py-aiohttp) is vulnerable:
> >   aiohttp -- open redirect vulnerability
> >   CVE: CVE-2021-21330
> >   WWW: https://vuxml.FreeBSD.org/freebsd/3000acee-c45d-11eb-904f-14dae9d5a9d2.html
> > 
> > 1 problem(s) found.
> 
> However, AFAICT following the link, this CVE was fixed in 3.7.4.
> Is this version vulnerable or not?
> 
> Reading https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=256219, IIUIC,
> looks like answer is no.
> Is then something wrong with my audit database?

>From reading the ticket it's probably a problem of the
PORTVERSION -- there's some ordering assumption, which causes
3.7.4 to be newer than 3.7.4.post0.

-- 
pi@opsec.eu            +49 171 3101372                    Now what ?