From owner-freebsd-ports@freebsd.org  Sun May 24 13:44:03 2020
Return-Path: <owner-freebsd-ports@freebsd.org>
Delivered-To: freebsd-ports@mailman.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
 by mailman.nyi.freebsd.org (Postfix) with ESMTP id 4DF4132E4D2
 for <freebsd-ports@mailman.nyi.freebsd.org>;
 Sun, 24 May 2020 13:44:03 +0000 (UTC) (envelope-from pi@freebsd.org)
Received: from home.opsec.eu (home.opsec.eu [IPv6:2001:14f8:200::1])
 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 49VLzl1N6Lz43d1
 for <freebsd-ports@freebsd.org>; Sun, 24 May 2020 13:44:02 +0000 (UTC)
 (envelope-from pi@freebsd.org)
Received: from pi by home.opsec.eu with local (Exim 4.92.3 (FreeBSD))
 (envelope-from <pi@freebsd.org>)
 id 1jcqv2-000OYP-1d; Sun, 24 May 2020 15:44:00 +0200
Date: Sun, 24 May 2020 15:44:00 +0200
From: Kurt Jaeger <pi@freebsd.org>
To: Dirk Engling <erdgeist@erdgeist.org>
Cc: freebsd-ports <freebsd-ports@freebsd.org>
Subject: Re: looking for committer, fixing qmail RCE
Message-ID: <20200524134400.GD39563@home.opsec.eu>
References: <31f3ecf4-0dc5-def9-e240-6661e319a533@erdgeist.org>
 <20200524130055.GC39563@home.opsec.eu>
 <45c17003-42bc-a8fd-6707-815215ff67d5@erdgeist.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <45c17003-42bc-a8fd-6707-815215ff67d5@erdgeist.org>
X-Rspamd-Queue-Id: 49VLzl1N6Lz43d1
X-Spamd-Bar: /
Authentication-Results: mx1.freebsd.org;
	none
X-Spamd-Result: default: False [0.00 / 15.00];
 local_wl_from(0.00)[freebsd.org];
 ASN(0.00)[asn:12502, ipnet:2001:14f8::/32, country:DE]
X-BeenThere: freebsd-ports@freebsd.org
X-Mailman-Version: 2.1.33
Precedence: list
List-Id: Porting software to FreeBSD <freebsd-ports.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-ports>,
 <mailto:freebsd-ports-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ports/>
List-Post: <mailto:freebsd-ports@freebsd.org>
List-Help: <mailto:freebsd-ports-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-ports>,
 <mailto:freebsd-ports-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 24 May 2020 13:44:03 -0000

Hi!

> On 24.05.20 15:00, Kurt Jaeger wrote:
> 
> >> This PR was two months old, before recently an RCE was discovered that
> >> would very much like to see fixed in ports.

> Sure, was already at it, then I stumbled about the syntax for how to
> report what combination of version and PORTREVISION to report for slave
> ports, as they don't follow the same numbering scheme.
> 
> These are the port versions / revision not affected anymore
> 
> qmail-1.06_5
> qmail-tls-1.06_3
> qmail-mysql-1.06_2
> 
> Am I supposed to bump all PORTREVISION to the same number or do I have
> to add entries for each slaveport? The <affects> section doesn't seem to
> have a concept of different version for slave ports.

Use three vuxml entries, one for each port (referencing 3 CVEs per entry).

-- 
pi@opsec.eu            +49 171 3101372                    Now what ?