From nobody Fri Sep 22 10:39:19 2023 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4RsTKM5dPcz4tgdM; Fri, 22 Sep 2023 10:39:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4RsTKM537gz4rln; Fri, 22 Sep 2023 10:39:19 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1695379159; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=+Dw6C5MMEwPqruQ5TRIbE8m6PYG0NLOmuAAw1UOr2a0=; b=CMq3C5v9SZVpmW0jkZ/ec9IpQeT3Of7K829aSFVMA2LgZyuNzUaJrNioSz6i6W6EZe3GkK tFppWHJhbN0N4ercY9XEhPGot3mtZmF7IyCkE5Y53pNynhO+N1jfJr+TSa4ISiS9Zn75Os ruRZGvsyzfFf8HFLhIw9JLqiGPWuxyG0iDX0F2wG2d5wFoJXT4vy4uX0YS9lB2mPgvfI2o KhmKFN2my6pZ1eEXsLH6PwAGjdHW9QunkNsLVm2V3hKrchagtelipKMxqlJ83EHJO8rEn/ Hsl6IqVxCQNNjGvQOaCmTZVBlpUbeg3cRb52FL6V3oBjs52RAftvw2F+xWWLFA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1695379159; a=rsa-sha256; cv=none; b=IfbClYz/iFnoYNCb8fEtzg8V0rbN7iuCnqrgn45IGT7Kf9X/k6H1dfPO6dEZfPu2SOZ6WF ZpjSVtoySXEJ4SVJXVpKTtB6K9+8UTyajivF2jPyrH/kM64JkIwSk94O1pYYLC4vO9SpbV vMCmq/KODVLuCDeLBCflMM+0q7iNPw112Z6dCRzIEQLhW3dcZnO6t0jwP2glipohcu/qWz eMzPRjGzP7ByQOL+rzB5s9MDzJrI8f07MM8g14ku+WO9atdsIkMLN266KD966dt+uUNb8f QxOCf2UP6vkYuAKtJYEfDa81hO6UQWmV7lWSYaF96kD+AbvggbqH+Z3rf8zR/Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1695379159; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=+Dw6C5MMEwPqruQ5TRIbE8m6PYG0NLOmuAAw1UOr2a0=; b=VBXWrdv3TwQjduNt+1xkwo+aNxjfMPvH3yx7g335Nrd1vBZN/5imqV82qJnwn84+8kV0lm lS0EpfJItAw3qiDVEsJmf5FX7lmbHM7xNKesTs/BaX+RtrhnTCNcz6RijmyT/ReIyXu/a0 zVnTGGhfnaSaqpR2W4uL1U7RJPTnEG6IBT4OktuMw8LFzRHpw/8hcOl5ekNTMY79VHqySI DeVay6cNAjbiSN/Mo92XSuZtWb1OnDxx0ZMy+0/I1zLZ9u9Flcoeda3MvHH/uV+V8H8T49 AmXvigJpN6aLMPOeVaUNIZFziCAZ0zKCErh5GRfVvgSVTCgvZZOACWX6tvOy8w== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4RsTKM3ktZz329; Fri, 22 Sep 2023 10:39:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 38MAdJFb015780; Fri, 22 Sep 2023 10:39:19 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 38MAdJbA015777; Fri, 22 Sep 2023 10:39:19 GMT (envelope-from git) Date: Fri, 22 Sep 2023 10:39:19 GMT Message-Id: <202309221039.38MAdJbA015777@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Fernando =?utf-8?Q?Apestegu=C3=ADa?= Subject: git: eb54bae70a84 - main - security/vuxml: Remove spurious file List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-all@freebsd.org X-BeenThere: dev-commits-ports-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: fernape X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: eb54bae70a84effe0d024cfd343c6698ad61fc86 Auto-Submitted: auto-generated The branch main has been updated by fernape: URL: https://cgit.FreeBSD.org/ports/commit/?id=eb54bae70a84effe0d024cfd343c6698ad61fc86 commit eb54bae70a84effe0d024cfd343c6698ad61fc86 Author: Fernando Apesteguía AuthorDate: 2023-09-22 10:22:02 +0000 Commit: Fernando Apesteguía CommitDate: 2023-09-22 10:39:05 +0000 security/vuxml: Remove spurious file Fixes: 20c93ef1ae8f43a36f9b05e79e6531b6186f3a86 --- security/vuxml/attachment.cgi?id=244811 | 57 --------------------------------- 1 file changed, 57 deletions(-) diff --git a/security/vuxml/attachment.cgi?id=244811 b/security/vuxml/attachment.cgi?id=244811 deleted file mode 100644 index 20c93ef1ae8f..000000000000 --- a/security/vuxml/attachment.cgi?id=244811 +++ /dev/null @@ -1,57 +0,0 @@ -From 7ea414f0f67c4e6e54d86d54fd639ff476d9af73 Mon Sep 17 00:00:00 2001 -From: Yasuhiro Kimura -Date: Thu, 14 Sep 2023 00:15:37 +0900 -Subject: [PATCH] security/vuxml: Document "eat all memory" vulnerability in - curl - ---- - security/vuxml/vuln/2023.xml | 36 ++++++++++++++++++++++++++++++++++++ - 1 file changed, 36 insertions(+) - -diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml -index eb3c8fd68d81..862e66ee01b6 100644 ---- a/security/vuxml/vuln/2023.xml -+++ b/security/vuxml/vuln/2023.xml -@@ -1,3 +1,39 @@ -+ -+ curl -- HTTP headers eat all memory -+ -+ -+ curl -+ 8.3.0 -+ -+ -+ -+ -+

selmelc on hackerone reports:

-+
-+

-+ When curl retrieves an HTTP response, it stores the -+ incoming headers so that they can be accessed later via -+ the libcurl headers API. -+

-+

-+ However, curl did not have a limit in how many or how -+ large headers it would accept in a response, allowing a -+ malicious server to stream an endless series of headers -+ and eventually cause curl to run out of heap memory. -+

-+
-+ -+ -+ -+ CVE-2023-38039 -+ https://curl.se/docs/CVE-2023-38039.html HERE -+ -+ -+ 2023-09-13 -+ 2023-09-13 -+ -+ -+ - - Roundcube -- XSS vulnerability - --- -2.42.0 -