svn commit: r321570 - in head: security/vuxml sysutils/puppet sysutils/puppet/files sysutils/puppet27

Sat Jun 22 12:49:30 UTC 2013

Author: swills
Date: Sat Jun 22 12:49:28 2013
New Revision: 321570
URL: http://svnweb.freebsd.org/changeset/ports/321570

Log:
  - Update puppet to 3.2.2 which fixes CVE-2013-3567 [1]
  - Update puppet27 to 2.7.22 which fixes CVE-2013-3567
  - Document security issue
  
  PR:		ports/179816 [1]
  Submitted by:	mat [1]
  Security:	b162b218-c547-4ba2-ae31-6fdcb61bc763

Deleted:
  head/sysutils/puppet/files/patch-service-freebsd.rb
Modified:
  head/security/vuxml/vuln.xml
  head/sysutils/puppet/Makefile
  head/sysutils/puppet/distinfo
  head/sysutils/puppet27/Makefile
  head/sysutils/puppet27/distinfo

Modified: head/security/vuxml/vuln.xml
==============================================================================

--- head/security/vuxml/vuln.xml	Sat Jun 22 12:18:39 2013	(r321569)
+++ head/security/vuxml/vuln.xml	Sat Jun 22 12:49:28 2013	(r321570)
@@ -51,6 +51,41 @@ Note:  Please add new entries to the beg
 
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="b162b218-c547-4ba2-ae31-6fdcb61bc763">
+    <topic>puppet -- Unauthenticated Remote Code Execution Vulnerability</topic>
+    <affects>
+      <package>
+	<name>puppet</name>
+	<range><lt>3.2.2</lt></range>
+      </package>
+      <package>
+	<name>puppet27</name>
+	<range><ge>2.7</ge><lt>2.7.22</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Puppet Developers report:</p>
+	<blockquote cite="http://puppetlabs.com/security/cve/cve-2013-3567/">
+	  <p>When making REST api calls, the puppet master takes YAML from an
+	      untrusted client, deserializes it, and then calls methods on the
+	      resulting object. A YAML payload can be crafted to cause the
+	      deserialization to construct an instance of any class available in
+	      the ruby process, which allows an attacker to execute code
+	      contained in the payload.
+	  </p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2013-3567</cvename>
+    </references>
+    <dates>
+      <discovery>2013-06-13</discovery>
+      <entry>2013-06-22</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="8b97d289-d8cf-11e2-a1f5-60a44c524f57">
     <topic>otrs -- information disclosure</topic>
     <affects>

Modified: head/sysutils/puppet/Makefile
==============================================================================
--- head/sysutils/puppet/Makefile	Sat Jun 22 12:18:39 2013	(r321569)
+++ head/sysutils/puppet/Makefile	Sat Jun 22 12:49:28 2013	(r321570)
@@ -2,8 +2,7 @@
 # $FreeBSD$
 
 PORTNAME=	puppet
-PORTVERSION=	3.1.1
-PORTREVISION=	2
+PORTVERSION=	3.2.2
 CATEGORIES=	sysutils
 MASTER_SITES=	http://downloads.puppetlabs.com/puppet/
 
@@ -41,11 +40,14 @@ MAN8=	extlookup2hiera.8 puppet-agent.8 p
 	puppet-resource_type.8 puppet-secret_agent.8 puppet-status.8 \
 	puppet.8
 
-OPTIONS_DEFINE=		MONGREL PACKAGE_ORIGIN PACKAGE_ROOT
+OPTIONS_DEFINE=		MONGREL
 OPTIONS_DEFAULT=	PACKAGE_ORIGIN
+OPTIONS_SINGLE=         PATCHES
+OPTIONS_SINGLE_PATCHES=	PACKAGE_ORIGIN PACKAGE_ROOT
 MONGREL_DESC=		Run puppet server as a mongrel service
 PACKAGE_ORIGIN_DESC=	Use port origin as package name
 PACKAGE_ROOT_DESC=	Use PACKAGEROOT insted of PACKAGESITE
+PATCHES_DESC=           Optional exclusive patches
 
 .include <bsd.port.options.mk>
 

Modified: head/sysutils/puppet/distinfo
==============================================================================
--- head/sysutils/puppet/distinfo	Sat Jun 22 12:18:39 2013	(r321569)
+++ head/sysutils/puppet/distinfo	Sat Jun 22 12:49:28 2013	(r321570)
@@ -1,2 +1,2 @@
-SHA256 (puppet-3.1.1.tar.gz) = 4401f6388bb96b1301a107f247af6fa558127d78467bb5cef1a1e0ff66b4463d
-SIZE (puppet-3.1.1.tar.gz) = 1587190
+SHA256 (puppet-3.2.2.tar.gz) = c47745aa73912b2cb1a20b07e8741b8af37a920b9bc8dc8afb14b23d8df7d13d
+SIZE (puppet-3.2.2.tar.gz) = 1784340

Modified: head/sysutils/puppet27/Makefile
==============================================================================
--- head/sysutils/puppet27/Makefile	Sat Jun 22 12:18:39 2013	(r321569)
+++ head/sysutils/puppet27/Makefile	Sat Jun 22 12:49:28 2013	(r321570)
@@ -2,8 +2,7 @@
 # $FreeBSD$
 
 PORTNAME=	puppet
-PORTVERSION=	2.7.21
-PORTREVISION=	1
+PORTVERSION=	2.7.22
 CATEGORIES=	sysutils
 MASTER_SITES=	http://downloads.puppetlabs.com/puppet/
 
@@ -43,11 +42,14 @@ MAN8=	filebucket.8 pi.8 puppet-agent.8 p
 	puppet.8 puppetca.8 puppetd.8 puppetdoc.8 puppetmasterd.8 \
 	puppetqd.8 puppetrun.8 ralsh.8
 
-OPTIONS_DEFINE=		MONGREL PACKAGE_ORIGIN PACKAGE_ROOT
+OPTIONS_DEFINE=		MONGREL
 OPTIONS_DEFAULT=	PACKAGE_ORIGIN
+OPTIONS_SINGLE=		PATCHES
+OPTIONS_SINGLE_PATCHES=	PACKAGE_ORIGIN PACKAGE_ROOT
 MONGREL_DESC=		Run puppet server as a mongrel service
 PACKAGE_ORIGIN_DESC=	Use port origin as package name
 PACKAGE_ROOT_DESC=	Use PACKAGEROOT insted of PACKAGESITE
+PATCHES_DESC=		Optional exclusive patches
 
 .include <bsd.port.options.mk>
 

Modified: head/sysutils/puppet27/distinfo
==============================================================================
--- head/sysutils/puppet27/distinfo	Sat Jun 22 12:18:39 2013	(r321569)
+++ head/sysutils/puppet27/distinfo	Sat Jun 22 12:49:28 2013	(r321570)
@@ -1,2 +1,2 @@
-SHA256 (puppet-2.7.21.tar.gz) = c18b426457d023e87745f0a98b7dd257f8e94722b5b0d3cafb6048ef2499273f
-SIZE (puppet-2.7.21.tar.gz) = 1998848
+SHA256 (puppet-2.7.22.tar.gz) = bfd79c0aecdeea4e1a8573e9325fbcb48778603d908180e88897458f01fe06de
+SIZE (puppet-2.7.22.tar.gz) = 2023230
