Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 12 Jun 2022 14:49:35 -0500
From:      Tim Daneliuk <tundra@tundraware.com>
To:        FreeBSD Mailing List <freebsd-questions@freebsd.org>
Subject:   Curious Ports Behavior
Message-ID:  <e06cf4d2-4711-ec12-0a36-19243f6c1591@tundraware.com>

next in thread | raw e-mail | index | archive | help
Two machines, one physical running on an older i5.

The other is a cloud based virtual machine.

Both running 13.1-STABLE as of 6/1/2022

I just did a fresh clone of the ports tree on both machines before asking here.

When I attempt to compile www/apache23 on the VM, I have no problems.

But attempting to compile www/apach23 on the physical machine emits this:

===>  apache24-2.4.54 has known vulnerabilities:
apache24-2.4.54 is vulnerable:
   Apache httpd -- Multiple vulnerabilities
   CVE: CVE-2022-26377
   CVE: CVE-2022-28330
   CVE: CVE-2022-28614
   CVE: CVE-2022-28615
   CVE: CVE-2022-29404
   CVE: CVE-2022-30522
   CVE: CVE-2022-30556
   CVE: CVE-2022-31813
   WWW: https://vuxml.FreeBSD.org/freebsd/49adfbe5-e7d1-11ec-8fbd-d4c9ef517024.html


IOW, the physical machine port installation stops because of known vulnerabilities,
but the VM instance works fine.

There is no evidence of "DISABLE_VULNERABILITIES" in the VM's environment or /etc/make.conf


Can anyone suggest a reason for this difference of behavior and/or a possible remediation.

I don't want servers running with high severity vulnerabilities ...



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?e06cf4d2-4711-ec12-0a36-19243f6c1591>