git: a1d339358646 - main - security/vuxml: Mark java/bouncycastle as vulnerable where applicable

From: Mateusz Piotrowski <0mp_at_FreeBSD.org>
Date: Thu, 25 Nov 2021 01:54:39 UTC 
The branch main has been updated by 0mp:

URL: https://cgit.FreeBSD.org/ports/commit/?id=a1d339358646f807e73e8a5130ff2cde983c3e32

commit a1d339358646f807e73e8a5130ff2cde983c3e32
Author:     Mateusz Piotrowski <0mp@FreeBSD.org>
AuthorDate: 2021-11-25 01:51:41 +0000
Commit:     Mateusz Piotrowski <0mp@FreeBSD.org>
CommitDate: 2021-11-25 01:54:25 +0000

    security/vuxml: Mark java/bouncycastle as vulnerable where applicable
    
    Some of the reported java/bouncycastle15 security issues affect the
    legacy port of java/bouncycastle as well. Update vuxml.xml accordingly.
    
    Sponsored by:   Modirum MDPay
    Sponsored by:   Klara, Inc.
---
 security/vuxml/vuln-2017.xml | 4 ++++
 security/vuxml/vuln-2018.xml | 4 ++++
 security/vuxml/vuln-2021.xml | 8 ++++++--
 3 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/security/vuxml/vuln-2017.xml b/security/vuxml/vuln-2017.xml
index 042ca4a18394..9e78bc4ba88c 100644
--- a/security/vuxml/vuln-2017.xml
+++ b/security/vuxml/vuln-2017.xml
@@ -50,6 +50,10 @@
   <vuln vid="6a131fbf-ec76-11e7-aa65-001b216d295b">
     <topic>The Bouncy Castle Crypto APIs: CVE-2017-13098 ("ROBOT")</topic>
     <affects>
+      <package>
+	<name>bouncycastle</name>
+	<range><lt>1.59</lt></range>
+      </package>
       <package>
 	<name>bouncycastle15</name>
 	<range><lt>1.59</lt></range>
diff --git a/security/vuxml/vuln-2018.xml b/security/vuxml/vuln-2018.xml
index f7070bce36c7..ccf9fab5631e 100644
--- a/security/vuxml/vuln-2018.xml
+++ b/security/vuxml/vuln-2018.xml
@@ -5627,6 +5627,10 @@ a PingInterval period.</p>
   <vuln vid="fe93803c-883f-11e8-9f0c-001b216d295b">
     <topic>Several Security Defects in the Bouncy Castle Crypto APIs</topic>
     <affects>
+      <package>
+	<name>bouncycastle</name>
+	<range><lt>1.60</lt></range>
+      </package>
       <package>
 	<name>bouncycastle15</name>
 	<range><lt>1.60</lt></range>
diff --git a/security/vuxml/vuln-2021.xml b/security/vuxml/vuln-2021.xml
index 60390f655b37..03289dce1536 100644
--- a/security/vuxml/vuln-2021.xml
+++ b/security/vuxml/vuln-2021.xml
@@ -3216,7 +3216,7 @@ The string hashing algorithm has been replaced with a better one, and now also u
     <affects>
       <package>
 	<name>bouncycastle15</name>
-	<range><lt>1.67</lt></range>
+	<range><ge>1.65</ge><lt>1.67</lt></range>
       </package>
     </affects>
     <description>
@@ -3243,12 +3243,16 @@ The string hashing algorithm has been replaced with a better one, and now also u
   </vuln>
 
   <vuln vid="89d5bca6-0150-11ec-bf0c-080027eedc6a">
-    <topic>bouncycastle15 -- EC math vulnerability</topic>
+    <topic>The Bouncy Castle Crypto APIs -- EC math vulnerability</topic>
     <affects>
       <package>
 	<name>bouncycastle15</name>
 	<range><lt>1.66</lt></range>
       </package>
+      <package>
+	<name>bouncycastle</name>
+	<range><lt>1.66</lt></range>
+      </package>
     </affects>
     <description>
       <body xmlns="http://www.w3.org/1999/xhtml">