From nobody Tue Feb 22 13:47:01 2022 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4CA8919E2EB9; Tue, 22 Feb 2022 13:47:02 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4K30pF5wgJz4wlR; Tue, 22 Feb 2022 13:47:01 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1645537622; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=2UJ7kam/y/w/YZA8QDhVLlakiAC5KvZAWCM//5yHzXk=; b=T+XNcrC1R4EcllDobPzad8z4bxDP2vrttDfg3GnsfEn1XXyBphNhBLouo5yjqszCYOLzYd 84IiDIep+iOwxdj3b6D4hhEnnKGdJdttKWOmC6ZX1engVE95ED+FYeh54yeAkkDMFLNhFO c/8z3dKRTnWbbEQvJXocyOY1AGhvGMMJs1kvLh2A/zh45n8JiGDF1tCTvW21U/S0c7Z+MT 9CSByMFTpmP5kXqyPdnGZBdzuuTeWJvoiRLz3gMg44HVwi9GQZkiTejcEsX1iRW8mTtGh7 P64BE4jLf1mCOYHT5bAU4hq1U3iLyiAivMVv3u1Mf9J7dEmuA3rp8Qkn193GLQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 88CDE25328; Tue, 22 Feb 2022 13:47:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 21MDl1Ag026849; Tue, 22 Feb 2022 13:47:01 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 21MDl1uW026848; Tue, 22 Feb 2022 13:47:01 GMT (envelope-from git) Date: Tue, 22 Feb 2022 13:47:01 GMT Message-Id: <202202221347.21MDl1uW026848@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Dmitry Marakasov Subject: git: 8ea19b1d123c - main - security/vuxml: py-tuf vulnerability List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-all@freebsd.org X-BeenThere: dev-commits-ports-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: amdmi3 X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 8ea19b1d123c53e92e544d1faccff9fe6b7327a1 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1645537622; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=2UJ7kam/y/w/YZA8QDhVLlakiAC5KvZAWCM//5yHzXk=; b=Q7PPg5rAExcHim3vM9XZi7KFkjbK5tPexoZjuCrg/Btd2veg89ADo5STA6rysirVhx+LC8 z5ixGAbshSzxcZj/WkXr4CFjhg/6iSR7t7YYvH7Q5Kn/gGE0i7gHuIYOpnDyGqjWkqzPdG brBq/y92pEWn8/WC11pXvYlF/MbWKwqiNz3I4eI4oPcH2yojIqtnVodY+bsttpLl34fusj 8aIwJXeSAbiAWJWCmdWVXT+Lw6OHrP9dHt81fN7VKp2DT/KbaHSxsmQPq65WB7kfSlW3oB zjpyjuO9qLBasSobvvG2yhCRCE6aE3SfyFpccCOQj+gLAJxyWHIyuCZT5sPcYQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1645537622; a=rsa-sha256; cv=none; b=YlJkX7QMAO1p/36hP67w56sIUORLsXgoMw2vB9N2m3xX2TBIkzxeQhMx63htQQitdMDR/b ARTgOVAKHWJt/j2FfuUofKKbp7iqL1+C0I86Ve7m8C7G5825UuuiN5Acaqvzy2SbUjV6zo 6nCDdYY47BlUPu01lVhYkdqMqngJhTXFu3OEZWcQ+q7LYOdGvgTn8Y6f69FxBb18uWLkiH dz1roaH0VAqd1EahHEIrxr2F1ar5wiOs3zjlBgIJOU/ITQWm3qRuc1inrfm/mWKyiGO/Sk 8cWFlb2kKLgJbaOKgU1HuboTXnBE++Rp1d5SR88eXECR09s5T77lOpA+y7zy2w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by amdmi3: URL: https://cgit.FreeBSD.org/ports/commit/?id=8ea19b1d123c53e92e544d1faccff9fe6b7327a1 commit 8ea19b1d123c53e92e544d1faccff9fe6b7327a1 Author: Dmitry Marakasov AuthorDate: 2022-02-22 13:45:17 +0000 Commit: Dmitry Marakasov CommitDate: 2022-02-22 13:46:41 +0000 security/vuxml: py-tuf vulnerability --- security/vuxml/vuln-2022.xml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/security/vuxml/vuln-2022.xml b/security/vuxml/vuln-2022.xml index cf8aeb1457b1..5ff1b0674f91 100644 --- a/security/vuxml/vuln-2022.xml +++ b/security/vuxml/vuln-2022.xml @@ -1,3 +1,33 @@ + + The Update Framwork -- path traversal vulnerability + + + py37-tuf + py38-tuf + py39-tuf + py310-tuf + py311-tuf + 0.18.1 + + + + +

NVD reports:

+
+

python-tuf is a Python reference implementation of The Update Framework (TUF). In both clients (`tuf/client` and `tuf/ngclient`), there is a path traversal vulnerability that in the worst case can overwrite files ending in `.json` anywhere on the client system on a call to `get_one_valid_targetinfo()`. It occurs because the rolename is used to form the filename, and may contain path traversal characters (ie `../../name.json`). The impact is mitigated by a few facts: It only affects implementations that allow arbitrary rolename selection for delegated targets metadata, The attack requires the ability to A) insert new metadata for the path-traversing role and B) get the role delegated by an existing targets metadata, The written file content is heavily restricted since it needs to be a valid, signed targets file. The file extension is always .json. A fix is available in version 0.19 or newer. There are no workarounds that do not require code changes. Clients can restrict the all owed character set for rolenames, or they can store metadata in files named in a way that is not vulnerable: neither of these approaches is possible without modifying python-tuf.

+
+ + + + CVE-2021-41131 + https://nvd.nist.gov/vuln/detail/CVE-2021-41131 + + + 2021-10-22 + 2022-02-22 + + + seatd-launch -- remove files with escalated privileges with SUID