Re: git: 03bfa3969e0d - main - security/vuxml: Mark security/zeek < 8.0.6 as vulnerable as per:
Date: Thu, 29 Jan 2026 23:59:05 UTC
On 1/29/26 15:45, Dan Langille wrote: > On Thu, Jan 29, 2026, at 5:45 PM, Craig Leres wrote: >> The branch main has been updated by leres: >> >> URL: >> https://cgit.FreeBSD.org/ports/commit/? >> id=03bfa3969e0d9c35069c9c80d6c570244e5ea428 >> >> commit 03bfa3969e0d9c35069c9c80d6c570244e5ea428 >> Author: Craig Leres<leres@FreeBSD.org> >> AuthorDate: 2026-01-29 22:44:39 +0000 >> Commit: Craig Leres<leres@FreeBSD.org> >> CommitDate: 2026-01-29 22:44:39 +0000 >> >> security/vuxml: Mark security/zeek < 8.0.6 as vulnerable as per: >> >> https://github.com/zeek/zeek/releases/tag/v8.0.6 >> >> This release fixes the following potential DoS vulnerability: >> >> - Zeek's HTTP analyzer can be tricked into interpreting Transfer-Encoding >> or Content-Length headers set in MIME entities within HTTP bodies >> and change the analyzer behavior. >> >> Reported by: Tim Wojtulewicz >> --- >> security/vuxml/vuln/2026.xml | 28 ++++++++++++++++++++++++++++ >> 1 file changed, 28 insertions(+) >> >> diff --git a/security/vuxml/vuln/2026.xml b/security/vuxml/vuln/2026.xml >> index c70d67182a1f..bb73ba15236f 100644 >> --- a/security/vuxml/vuln/2026.xml >> +++ b/security/vuxml/vuln/2026.xml >> @@ -1,3 +1,31 @@ >> + <vuln vid="8173e68a-88f3-4862-882c-6e58779d98e7"> >> + <topic>zeek -- potential DoS vulnerability</topic> >> + <affects> >> +<package> >> +<name></name> > Name needs a value. Fixed with 649e3cfe1b3a, thanks! Craig