ports/117931: [PATCH] devel/bugzilla2: Update port name after repocopy to avoid portaudit false positives

Greg Larkin glarkin at sourcehosting.net
Fri Nov 9 00:00:03 UTC 2007


>Number:         117931
>Category:       ports
>Synopsis:       [PATCH] devel/bugzilla2: Update port name after repocopy to avoid portaudit false positives
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-ports-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          change-request
>Submitter-Id:   current-users
>Arrival-Date:   Fri Nov 09 00:00:02 UTC 2007
>Closed-Date:
>Last-Modified:
>Originator:     Greg Larkin
>Release:        FreeBSD 6.1-SECURITY i386
>Organization:
SourceHosting.net, LLC
>Environment:
System: FreeBSD ports.entropy.prv 6.1-SECURITY FreeBSD 6.1-SECURITY #0: Thu Apr 26 14:24:01 UTC 2007
>Description:

Once Bugzilla 3.0 was released, devel/bugzilla was repocopied to
devel/bugzilla2.  Since then, some security vulnerabilities were added to
the FreeBSD VuXML document.  Bugzilla-2.22.3 is flagged as vulnerable,
when it is not.

Port maintainer (skv at FreeBSD.org) is cc'd.

Generated with FreeBSD Port Tools 0.77
>How-To-Repeat:

Run portaudit in the original devel/bugzilla2 directory and notice
that version 2.22.3 is compared against version 3.0.1.  After changing
the port name, no vulnerabilities are flagged.

ports# pwd
/usr/ports/devel/bugzilla2.orig
ports# portaudit -Cv
Affected package: bugzilla-2.22.3 (matched by bugzilla<3.0.1)
Type of problem: bugzilla -- multiple vulnerabilities.
Reference: <http://www.FreeBSD.org/ports/portaudit/75231c63-f6a2-499d-8e27-78777
3bda284.html>

Affected package: bugzilla-2.22.3 (matched by bugzilla<3.0.2)
Type of problem: bugzilla -- "createmailregexp" security bypass vulnerability.
Reference: <http://www.FreeBSD.org/ports/portaudit/f8d3689e-6770-11dc-8be8-02e01
85f8d72.html>

ports# cd ../bugzilla2
ports# portaudit -Cv
ports#

>Fix:

--- bugzilla2-2.22.3.patch begins here ---
diff -ruN --exclude=CVS /usr/ports/devel/bugzilla2.orig/Makefile /usr/ports/devel/bugzilla2/Makefile
--- /usr/ports/devel/bugzilla2.orig/Makefile	Thu Aug 30 15:04:13 2007
+++ /usr/ports/devel/bugzilla2/Makefile	Thu Nov  8 18:34:57 2007
@@ -5,11 +5,12 @@
 # $FreeBSD: ports/devel/bugzilla2/Makefile,v 1.51 2007/08/30 19:04:13 skv Exp $
 #
 
-PORTNAME?=	bugzilla
+PORTNAME?=	bugzilla2
 PORTVERSION?=	2.22.3
 CATEGORIES?=	devel
 MASTER_SITES=	${MASTER_SITE_MOZILLA}
 MASTER_SITE_SUBDIR=	webtools webtools/archived
+DISTNAME=	bugzilla-${PORTVERSION}
 
 MAINTAINER?=	skv at FreeBSD.org
 COMMENT?=	Bug-tracking system developed by Mozilla Project
--- bugzilla2-2.22.3.patch ends here ---

>Release-Note:
>Audit-Trail:
>Unformatted:



More information about the freebsd-ports-bugs mailing list