From nobody Wed Jun 22 19:11:51 2022 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id B8DA4876765; Wed, 22 Jun 2022 19:11:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4LStKg4vT2z3hF4; Wed, 22 Jun 2022 19:11:51 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1655925111; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=WEeWVDG08TtZeaxfZo6J3B2t4ctQV5KIvqAPPyV0Y14=; b=Xk/HFW9z7U25YNoFt4c8fiVxg1eJOXkhgnJaeNK5dX1gqgBXkRsUGEKmJ+Owx0CmrAIG3c qeCWT0XYrAg3VgMbSqcBDuS7ZzY96rJ1RKwGBxj/cM8+yM1lg7E2qB6r+MyFBDp/+bzLvg O0OjU94EDcuMM+/zSTJpzdBs2OpRzD3IMJJssnflsRvSNV5L8j9dXw5p4eY6cjL7LjAAYQ dOnj+pVRrwxsJcwGhkA9ehtPXPHJh/CaQj8AD2ozz3cXRffwgubeOM+nwb3W2AVqlSNJsX MvAhlzc+zVvTmuMTVTyju9YgJflr9pHGRuawt2TR/JtLiWGGFlC8D+PMO0dJyA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 7E37944A7; Wed, 22 Jun 2022 19:11:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 25MJBptn036886; Wed, 22 Jun 2022 19:11:51 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 25MJBpc8036885; Wed, 22 Jun 2022 19:11:51 GMT (envelope-from git) Date: Wed, 22 Jun 2022 19:11:51 GMT Message-Id: <202206221911.25MJBpc8036885@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Li-Wen Hsu Subject: git: 28676937f7e1 - main - security/vuxml: Document Jenkins Security Advisory 2022-06-22 List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-main@freebsd.org X-BeenThere: dev-commits-ports-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: lwhsu X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 28676937f7e12203df395188b61af15f451fa006 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1655925111; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=WEeWVDG08TtZeaxfZo6J3B2t4ctQV5KIvqAPPyV0Y14=; b=eDHH7zZX7O2WmIS5MWyrvX57oimHz1ydYXrk4z0owbX0uIuxvkC87xLN2z8sX31gryw+W2 SW5aiTjeGQsMizOKGCgegakidRobcXM2SWC24tLnBXSyFKU79vCMLKKpRqmS4sU/CBuyBz XA+egytTBDT2m8V6IurxJi8yURiNAzyK4G6sd/WR+uNv8r+S0wDA8TZbNFuJx37GIBE8Kx 3QZ54nQc8uVjDFK99w7w/Pu+hyQ6snKHVwcZbFd9SKzY2cR+NkDZ6u5iFmLZ5qy13w7SEg V8fem+qbAePC3Heeob5hoHaLRCKAkHT6ntrH4eX8DnUmWSObzno3HxY9nmyx3g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1655925111; a=rsa-sha256; cv=none; b=T+bJX2g+PYv92nO6RPx8eKgK1W6Yan3iaBF46mUUj/7GUkHq1TfZ8fZWDS2LblkdAA6GXe K610hbZmsboBra0G71pXP/y+FcmhYm7zynmpKTBgSIZDyMballns//sC+oxkB7/XyvB2Kg mQqkRESX7+DlzcRwG2GffEG30VgQbliaaxGznxLeUngGLj/tXf8umESIEHwfgtmTGmGMCt vk+V/CJZ/WUemTSymhtjSgLGPN+9Yw8+gIXffrVYggpxcIp2dyfKgVoslkqwqxgtwXcCgO XRM5YtVCNZFxcjAoaWZRoOmsPN941dLIghu//snxOMm5+SIlEix9hQKiE/knag== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by lwhsu: URL: https://cgit.FreeBSD.org/ports/commit/?id=28676937f7e12203df395188b61af15f451fa006 commit 28676937f7e12203df395188b61af15f451fa006 Author: Li-Wen Hsu AuthorDate: 2022-06-22 19:05:48 +0000 Commit: Li-Wen Hsu CommitDate: 2022-06-22 19:11:40 +0000 security/vuxml: Document Jenkins Security Advisory 2022-06-22 Sponsored by: The FreeBSD Foundation --- security/vuxml/vuln-2022.xml | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/security/vuxml/vuln-2022.xml b/security/vuxml/vuln-2022.xml index eb6d8c7f454d..d6f194bed4da 100644 --- a/security/vuxml/vuln-2022.xml +++ b/security/vuxml/vuln-2022.xml @@ -1,3 +1,44 @@ + + jenkins -- multiple vulnerabilities + + + jenkins + 2.356 + + + jenkins-lts + 2.346.1 + + + + +

Jenkins Security Advisory:

+
+

Description

+
(High) SECURITY-2781 / CVE-2022-34170 (SECURITY-2779), CVE-2022-34171 (SECURITY-2761), CVE-2022-34172 (SECURITY-2776), CVE-2022-34173 (SECURITY-2780)
+

Multiple XSS vulnerabilities

+
(Medium) SECURITY-2566 / CVE-2022-34174
+

Observable timing discrepancy allows determining username validity

+
(Medium) Unauthorized view fragment access
+

SECURITY-2777 / CVE-2022-34175

+
+ + + + CVE-2022-34170 + CVE-2022-34171 + CVE-2022-34172 + CVE-2022-34173 + CVE-2022-34174 + CVE-2022-34175 + https://www.jenkins.io/security/advisory/2022-06-22/ + + + 2022-06-22 + 2022-06-22 + + + OpenSSL -- Command injection vulnerability