Date: Sat, 25 Dec 2021 09:51:09 +0000 From: bugzilla-noreply@freebsd.org To: ports-bugs@FreeBSD.org Subject: [Bug 260675] www/matomo: update to 4.5.0 --> 4.6.2; maintainer change Message-ID: <bug-260675-7788@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D260675 Bug ID: 260675 Summary: www/matomo: update to 4.5.0 --> 4.6.2; maintainer change Product: Ports & Packages Version: Latest Hardware: Any URL: https://matomo.org/changelog/matomo-4-6-0/ OS: Any Status: New Keywords: patch, security Severity: Affects Many People Priority: --- Component: Individual Port(s) Assignee: joneum@FreeBSD.org Reporter: andrej@ebert.su CC: mfechner@FreeBSD.org Flags: maintainer-feedback?(joneum@FreeBSD.org) Assignee: joneum@FreeBSD.org Created attachment 230383 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D230383&action= =3Dedit git diff Changes: https://matomo.org/changelog/matomo-4-6-0/ https://matomo.org/changelog/matomo-4-6-2/ There is a security relevant bug fixed, but I didn't find a CVE for it and = the description in the changelog is rather... superficial: [snip] Security release This is a major security release. We fixed an issue where it was possible to gain access to any Matomo user account on a server running Nginx, where the Matomo user login is known and two-factor authentication is disabled and if the Matomo user could be trick= ed into doing some specific action. It is strongly recommended to use two-fact= or authentication for the safety of your account. This issue was responsibly disclosed to our Security team.=20 [/snip] Also changed maintainer to myself, as sugessted by current maintainer here:= bug #254157, comment #4 And now the patch to supress the file integrity warning caused by the shebangfix to misc/log-analytics/import_logs.py actually made it to the dif= f :) --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-260675-7788>