Date: Thu, 25 Nov 2021 01:54:39 GMT From: Mateusz Piotrowski <0mp@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: a1d339358646 - main - security/vuxml: Mark java/bouncycastle as vulnerable where applicable Message-ID: <202111250154.1AP1sdrF082169@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by 0mp: URL: https://cgit.FreeBSD.org/ports/commit/?id=a1d339358646f807e73e8a5130ff2cde983c3e32 commit a1d339358646f807e73e8a5130ff2cde983c3e32 Author: Mateusz Piotrowski <0mp@FreeBSD.org> AuthorDate: 2021-11-25 01:51:41 +0000 Commit: Mateusz Piotrowski <0mp@FreeBSD.org> CommitDate: 2021-11-25 01:54:25 +0000 security/vuxml: Mark java/bouncycastle as vulnerable where applicable Some of the reported java/bouncycastle15 security issues affect the legacy port of java/bouncycastle as well. Update vuxml.xml accordingly. Sponsored by: Modirum MDPay Sponsored by: Klara, Inc. --- security/vuxml/vuln-2017.xml | 4 ++++ security/vuxml/vuln-2018.xml | 4 ++++ security/vuxml/vuln-2021.xml | 8 ++++++-- 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/security/vuxml/vuln-2017.xml b/security/vuxml/vuln-2017.xml index 042ca4a18394..9e78bc4ba88c 100644 --- a/security/vuxml/vuln-2017.xml +++ b/security/vuxml/vuln-2017.xml @@ -50,6 +50,10 @@ <vuln vid="6a131fbf-ec76-11e7-aa65-001b216d295b"> <topic>The Bouncy Castle Crypto APIs: CVE-2017-13098 ("ROBOT")</topic> <affects> + <package> + <name>bouncycastle</name> + <range><lt>1.59</lt></range> + </package> <package> <name>bouncycastle15</name> <range><lt>1.59</lt></range> diff --git a/security/vuxml/vuln-2018.xml b/security/vuxml/vuln-2018.xml index f7070bce36c7..ccf9fab5631e 100644 --- a/security/vuxml/vuln-2018.xml +++ b/security/vuxml/vuln-2018.xml @@ -5627,6 +5627,10 @@ a PingInterval period.</p> <vuln vid="fe93803c-883f-11e8-9f0c-001b216d295b"> <topic>Several Security Defects in the Bouncy Castle Crypto APIs</topic> <affects> + <package> + <name>bouncycastle</name> + <range><lt>1.60</lt></range> + </package> <package> <name>bouncycastle15</name> <range><lt>1.60</lt></range> diff --git a/security/vuxml/vuln-2021.xml b/security/vuxml/vuln-2021.xml index 60390f655b37..03289dce1536 100644 --- a/security/vuxml/vuln-2021.xml +++ b/security/vuxml/vuln-2021.xml @@ -3216,7 +3216,7 @@ The string hashing algorithm has been replaced with a better one, and now also u <affects> <package> <name>bouncycastle15</name> - <range><lt>1.67</lt></range> + <range><ge>1.65</ge><lt>1.67</lt></range> </package> </affects> <description> @@ -3243,12 +3243,16 @@ The string hashing algorithm has been replaced with a better one, and now also u </vuln> <vuln vid="89d5bca6-0150-11ec-bf0c-080027eedc6a"> - <topic>bouncycastle15 -- EC math vulnerability</topic> + <topic>The Bouncy Castle Crypto APIs -- EC math vulnerability</topic> <affects> <package> <name>bouncycastle15</name> <range><lt>1.66</lt></range> </package> + <package> + <name>bouncycastle</name> + <range><lt>1.66</lt></range> + </package> </affects> <description> <body xmlns="http://www.w3.org/1999/xhtml">;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202111250154.1AP1sdrF082169>