From owner-svn-ports-all@FreeBSD.ORG Wed Jun 4 15:35:07 2014 Return-Path: Delivered-To: svn-ports-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 96D22F6C for ; Wed, 4 Jun 2014 15:35:07 +0000 (UTC) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 5F34B2F74 for ; Wed, 4 Jun 2014 15:35:07 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.8/8.14.8) with ESMTP id s54FZ7o5080194 for ; Wed, 4 Jun 2014 15:35:07 GMT (envelope-from bdrewery@freefall.freebsd.org) Received: (from bdrewery@localhost) by freefall.freebsd.org (8.14.8/8.14.8/Submit) id s54FZ7Wm080189 for svn-ports-all@freebsd.org; Wed, 4 Jun 2014 15:35:07 GMT (envelope-from bdrewery) Received: (qmail 96055 invoked from network); 4 Jun 2014 10:35:05 -0500 Received: from unknown (HELO blah) (freebsd@shatow.net@67.182.131.225) by sweb.xzibition.com with ESMTPA; 4 Jun 2014 10:35:05 -0500 Message-ID: <538F3CA8.2000103@FreeBSD.org> Date: Wed, 04 Jun 2014 10:35:04 -0500 From: "Drewery, Bryan" Organization: FreeBSD User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.5.0 MIME-Version: 1.0 To: Tijl Coosemans Subject: Re: svn commit: r356398 - head/security/vuxml References: <201406031942.s53JgeGI046605@svn.freebsd.org> <20140604103240.6826697f@kalimero.tijl.coosemans.org> <51539FB3-D510-479C-A076-87068BD01022@FreeBSD.org> <20140604142438.GA57245@exodus.zi0r.com> <538F3512.8040509@FreeBSD.org> <20140604172504.23a766e4@kalimero.tijl.coosemans.org> In-Reply-To: <20140604172504.23a766e4@kalimero.tijl.coosemans.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: Ryan Steinmetz , "svn-ports-head@freebsd.org" , "svn-ports-all@freebsd.org" , "novel@FreeBSD.org" , "ports-committers@freebsd.org" X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Jun 2014 15:35:07 -0000 On 6/4/14, 10:25 AM, Tijl Coosemans wrote: > On Wed, 04 Jun 2014 10:02:42 -0500 Drewery, Bryan wrote: >> On 6/4/14, 9:24 AM, Ryan Steinmetz wrote: >>> On (06/04/14 08:50), Bryan Drewery wrote: >>>>> On Jun 4, 2014, at 3:32, Tijl Coosemans wrote: >>>>>> On Tue, 3 Jun 2014 19:42:40 +0000 (UTC) Ryan Steinmetz wrote: >>>>>> Author: zi >>>>>> Date: Tue Jun 3 19:42:40 2014 >>>>>> New Revision: 356398 >>>>>> URL: http://svnweb.freebsd.org/changeset/ports/356398 >>>>>> QAT: https://qat.redports.org/buildarchive/r356398/ >>>>>> >>>>>> Log: >>>>>> - Document vulnerability in security/gnutls3 (CVE-2014-3466) >>>>> >>>>> Is security/gnutls affected by this as well? Because most ports are >>>>> still using that version. >>>> >>>> Not sure. That port needs to just die though and all ports use the new. >>> >>> GnuTLS' website doesn't mention 2.x, however, I did see someones post >>> that mentioned that the bad code may have been introduced in 1.x. > > There's a commit in the 2.12 branch for this so it is affected: > https://www.gitorious.org/gnutls/gnutls/commits/89238044ade02c4d80e334ab74056ef28599663d > >>> Given that 2.x seems deprecated/unsupported by the authors, I think we >>> really need to push to ditch it. >> >> It's already planned to do so. Just needs to have the work done. > > I could spend some time on this. Has there been any work done already? > I forget. I think novel may have started on it. I don't think it's anything significant to not just start over on though. -- Regards, Bryan Drewery