From nobody Mon Jan 23 13:13:01 2023 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4P0rBQ1jrfz2t0n8; Mon, 23 Jan 2023 13:13:02 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4P0rBQ1CNbz3MqJ; Mon, 23 Jan 2023 13:13:02 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1674479582; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=7A6BODzNo/c+6K3ioLzT5VL/iim1+5P4uHfbDxZVQZU=; b=V4bMSf2qd72un/pxNqdrpzoggOx0B8yn30gJQY+54XWKfURv9dLpQvU9ay4YxpGhoRGtWV DJuG+7/rdYLB39m8gWSeXP2kSUSr+fsSG/85+99/3kkCiEjfWon+h9omgmiyms2hccQ04O 8MeTebwZeguRMYZa1JxxurZqt5azTJbX24ukQBpvIaKPtlD2Mt/ncyzEcZRZeoggw1W5CI Uj8TaHRZRQMIJwIE0c7zYmRovoxgUF72pkmBqygZU/JqdjEIvnZZHTNevER92bjf5e9t+7 S+Ay60k95b0Eg8cxzsEj7nVbk/xFOf79z7eMNvNFpSOUY5rSGfS0OBdCXFOE8g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1674479582; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=7A6BODzNo/c+6K3ioLzT5VL/iim1+5P4uHfbDxZVQZU=; b=dMtbNXs7FvPUUSJDjz+7KT/KRi9YskN7V9QeHnbiiJpbZABcwwWxhJ35czKSp26wXpFwfJ FuztJxe47B1uF/I8JLtF9YYaPh9KvbDvlBZSIDd4cvKJwgIJGYpPI+fncwtYkwii5ewJRt icqJ1U8WoVEMI3Gs4ZbWYTno+R1wPjkBmMr5hb23eT3jYiNrYyAv8vCBN07OXjy38FRyVd QyS7iu5vh8RYi2sZKgOX2RA8o8Ola1Ycb192LideuiGGpV9sFQHnfpafFd7/sehWIZWosJ +fNYY1unTpLTPXvo+s0ZVOE1IPotdkAatKQFUByfpRqEmQkpWkoMmZ4vgKniQQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1674479582; a=rsa-sha256; cv=none; b=OlO/F5brV0Br1RYM5rfH550CuKj/yeH31MIDGetop4kAoBQ9jBjm1p10LdIo8Yk9N3ROCe NvL12kobOYiL4L0fOuD/22AICa9OfOHcwf1UMEhDlaiF3IkcI6pPZKJJsPbEI5yqV8jFeA CxMiC2/bgx6M6J0weofcFAehwSbiaNC/N6lpUL9YgMNvF/wT2w7kDNyi1bKDfguR1hV2a1 qxr0mqefGfJ8rtpnxNfxV1iAruqT6PwcKmiGgWYRD69viSLn6xdWkI8FPQQxYkUgLpb4fT M/HN0bwDZn0n1jRS37P7LFGEmA/dXxi+rH8F9uggoB3Do5OS67t3HjeXqRyyYg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4P0rBQ0GmqzWBs; Mon, 23 Jan 2023 13:13:02 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 30NDD1Q2043296; Mon, 23 Jan 2023 13:13:01 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 30NDD127043295; Mon, 23 Jan 2023 13:13:01 GMT (envelope-from git) Date: Mon, 23 Jan 2023 13:13:01 GMT Message-Id: <202301231313.30NDD127043295@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: =?utf-8?Q?Fernando=20Apestegu=C3=ADa?= Subject: git: 41493dcf982d - main - security/vuxml: register www/awstats vulnerability List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-all@freebsd.org X-BeenThere: dev-commits-ports-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: fernape X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 41493dcf982d8df241837f7f38453130e8fc9121 Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by fernape: URL: https://cgit.FreeBSD.org/ports/commit/?id=41493dcf982d8df241837f7f38453130e8fc9121 commit 41493dcf982d8df241837f7f38453130e8fc9121 Author: Fernando Apesteguía AuthorDate: 2023-01-23 13:03:16 +0000 Commit: Fernando Apesteguía CommitDate: 2023-01-23 13:08:45 +0000 security/vuxml: register www/awstats vulnerability PR: 269051 --- security/vuxml/vuln/2023.xml | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml index 31c3a7609799..988af50ea071 100644 --- a/security/vuxml/vuln/2023.xml +++ b/security/vuxml/vuln/2023.xml @@ -1,3 +1,35 @@ + + www/awstats -- Partial absolute pathname + + + awstats + 7.8 + + + + +

MITRE reports:

+
+

It seems #90 is not completely fixed in 7.8. + (that is, even after CVE-2017-1000501 and CVE-2020-29600 are fixed). + In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a + partial absolute pathname (omitting the initial /etc), even + though it was intended to only read a file in the /etc/awstats/awstats.conf format. + NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501 and CVE-2020-29600. +

+
+ + + + CVE-2020-35176 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35176 + + + 2022-12-11 + 2023-01-23 + + + net/eternalterminal -- Multiple vulnerabilities