git: 136fddc527ee - main - security/vuxml: add www/unit-java vulnerability
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Sun, 14 Sep 2025 17:39:22 UTC
The branch main has been updated by osa:
URL: https://cgit.FreeBSD.org/ports/commit/?id=136fddc527ee7ecc2c2abb1ccdecc0ba23fccec1
commit 136fddc527ee7ecc2c2abb1ccdecc0ba23fccec1
Author: Sergey A. Osokin <osa@FreeBSD.org>
AuthorDate: 2025-09-14 17:37:27 +0000
Commit: Sergey A. Osokin <osa@FreeBSD.org>
CommitDate: 2025-09-14 17:39:16 +0000
security/vuxml: add www/unit-java vulnerability
---
security/vuxml/vuln/2025.xml | 28 +++++++
www/unit/files/patch-auto_njs | 22 -----
www/unit/files/patch-src_nxt__http__js.c | 139 -------------------------------
3 files changed, 28 insertions(+), 161 deletions(-)
diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml
index fbc1d03321f7..0054882d6cd1 100644
--- a/security/vuxml/vuln/2025.xml
+++ b/security/vuxml/vuln/2025.xml
@@ -1,3 +1,31 @@
+ <vuln vid="f6ca7c47-9190-11f0-b8da-589cfc10a551">
+ <topic>unit-java -- security vulnerability</topic>
+ <affects>
+ <package>
+ <name>unit-java</name>
+ <range><lt>1.35.0</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>F5 reports:</p>
+ <blockquote cite="https://my.f5.com/manage/s/article/K000149959">
+ <p>When NGINX Unit with the Java Language Module is in use,
+ undisclosed requests can lead to an infinite loop and cause
+ an increase in CPU resource utilization.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2025-1695</cvename>
+ <url>https://nvd.nist.gov/vuln/detail/CVE-2025-1695</url>
+ </references>
+ <dates>
+ <discovery>2025-09-14</discovery>
+ <entry>2025-09-14</entry>
+ </dates>
+ </vuln>
+
<vuln vid="3aee6703-8ff6-11f0-b8da-589cfc10a551">
<topic>cups -- security vulnerabilities</topic>
<affects>
diff --git a/www/unit/files/patch-auto_njs b/www/unit/files/patch-auto_njs
deleted file mode 100644
index a4cbc6ec8d3c..000000000000
--- a/www/unit/files/patch-auto_njs
+++ /dev/null
@@ -1,22 +0,0 @@
---- auto/njs.orig 2025-02-27 22:02:21 UTC
-+++ auto/njs
-@@ -25,8 +25,8 @@ nxt_feature_test="#include <njs.h>
- nxt_feature_libs="$NXT_NJS_LIBS $NXT_NJS_AUX_LIBS"
- nxt_feature_test="#include <njs.h>
-
-- #if NJS_VERSION_NUMBER < 0x000803
-- # error njs < 0.8.3 is not supported.
-+ #if NJS_VERSION_NUMBER < 0x000900
-+ # error njs < 0.9.0 is not supported.
- #endif
-
- int main(void) {
-@@ -44,7 +44,7 @@ if [ $nxt_found = no ]; then
-
- if [ $nxt_found = no ]; then
- $echo
-- $echo $0: error: no njs library \>= 0.8.3 found.
-+ $echo $0: error: no njs library \>= 0.9.0 found.
- $echo
- exit 1;
- fi
diff --git a/www/unit/files/patch-src_nxt__http__js.c b/www/unit/files/patch-src_nxt__http__js.c
deleted file mode 100644
index 41a2a39a1c56..000000000000
--- a/www/unit/files/patch-src_nxt__http__js.c
+++ /dev/null
@@ -1,139 +0,0 @@
---- src/nxt_http_js.c.orig 2025-02-27 22:02:21 UTC
-+++ src/nxt_http_js.c
-@@ -9,27 +9,31 @@ static njs_int_t nxt_http_js_ext_uri(njs_vm_t *vm, njs
-
-
- static njs_int_t nxt_http_js_ext_uri(njs_vm_t *vm, njs_object_prop_t *prop,
-- njs_value_t *value, njs_value_t *setval, njs_value_t *retval);
-+ uint32_t atom_id, njs_value_t *value, njs_value_t *setval,
-+ njs_value_t *retval);
- static njs_int_t nxt_http_js_ext_host(njs_vm_t *vm, njs_object_prop_t *prop,
-- njs_value_t *value, njs_value_t *setval, njs_value_t *retval);
--static njs_int_t nxt_http_js_ext_remote_addr(njs_vm_t *vm,
-- njs_object_prop_t *prop, njs_value_t *value, njs_value_t *setval,
-+ uint32_t atom_id, njs_value_t *value, njs_value_t *setval,
- njs_value_t *retval);
-+static njs_int_t nxt_http_js_ext_remote_addr(njs_vm_t *vm,
-+ njs_object_prop_t *prop, uint32_t atom_id, njs_value_t *value,
-+ njs_value_t *setval, njs_value_t *retval);
- static njs_int_t nxt_http_js_ext_get_args(njs_vm_t *vm,
-- njs_object_prop_t *prop, njs_value_t *value, njs_value_t *setval,
-- njs_value_t *retval);
-+ njs_object_prop_t *prop, uint32_t atom_id, njs_value_t *value,
-+ njs_value_t *setval, njs_value_t *retval);
- static njs_int_t nxt_http_js_ext_get_header(njs_vm_t *vm,
-- njs_object_prop_t *prop, njs_value_t *value, njs_value_t *setval,
-- njs_value_t *retval);
-+ njs_object_prop_t *prop, uint32_t atom_id, njs_value_t *value,
-+ njs_value_t *setval, njs_value_t *retval);
- static njs_int_t nxt_http_js_ext_keys_header(njs_vm_t *vm,
- njs_value_t *value, njs_value_t *keys);
- static njs_int_t nxt_http_js_ext_get_cookie(njs_vm_t *vm,
-- njs_object_prop_t *prop, njs_value_t *value, njs_value_t *setval,
-+ njs_object_prop_t *prop, uint32_t atom_id, njs_value_t *value,
-+ njs_value_t *setval,
- njs_value_t *retval);
- static njs_int_t nxt_http_js_ext_keys_cookie(njs_vm_t *vm, njs_value_t *value,
- njs_value_t *keys);
- static njs_int_t nxt_http_js_ext_get_var(njs_vm_t *vm, njs_object_prop_t *prop,
-- njs_value_t *value, njs_value_t *setval, njs_value_t *retval);
-+ uint32_t atom_id, njs_value_t *value, njs_value_t *setval,
-+ njs_value_t *retval);
-
-
- static njs_external_t nxt_http_js_proto[] = {
-@@ -109,7 +113,7 @@ static njs_int_t
-
-
- static njs_int_t
--nxt_http_js_ext_uri(njs_vm_t *vm, njs_object_prop_t *prop,
-+nxt_http_js_ext_uri(njs_vm_t *vm, njs_object_prop_t *prop, uint32_t atom_id,
- njs_value_t *value, njs_value_t *setval, njs_value_t *retval)
- {
- nxt_http_request_t *r;
-@@ -126,7 +130,7 @@ static njs_int_t
-
-
- static njs_int_t
--nxt_http_js_ext_host(njs_vm_t *vm, njs_object_prop_t *prop,
-+nxt_http_js_ext_host(njs_vm_t *vm, njs_object_prop_t *prop, uint32_t atom_id,
- njs_value_t *value, njs_value_t *setval, njs_value_t *retval)
- {
- nxt_http_request_t *r;
-@@ -144,7 +148,8 @@ nxt_http_js_ext_remote_addr(njs_vm_t *vm, njs_object_p
-
- static njs_int_t
- nxt_http_js_ext_remote_addr(njs_vm_t *vm, njs_object_prop_t *prop,
-- njs_value_t *value, njs_value_t *setval, njs_value_t *retval)
-+ uint32_t atom_id, njs_value_t *value, njs_value_t *setval,
-+ njs_value_t *retval)
- {
- nxt_http_request_t *r;
-
-@@ -162,7 +167,8 @@ nxt_http_js_ext_get_args(njs_vm_t *vm, njs_object_prop
-
- static njs_int_t
- nxt_http_js_ext_get_args(njs_vm_t *vm, njs_object_prop_t *prop,
-- njs_value_t *value, njs_value_t *setval, njs_value_t *retval)
-+ uint32_t atom_id, njs_value_t *value, njs_value_t *setval,
-+ njs_value_t *retval)
- {
- u_char *start;
- njs_int_t ret;
-@@ -193,7 +199,8 @@ nxt_http_js_ext_get_header(njs_vm_t *vm, njs_object_pr
-
- static njs_int_t
- nxt_http_js_ext_get_header(njs_vm_t *vm, njs_object_prop_t *prop,
-- njs_value_t *value, njs_value_t *setval, njs_value_t *retval)
-+ uint32_t atom_id, njs_value_t *value, njs_value_t *setval,
-+ njs_value_t *retval)
- {
- njs_int_t rc;
- njs_str_t key;
-@@ -206,7 +213,7 @@ nxt_http_js_ext_get_header(njs_vm_t *vm, njs_object_pr
- return NJS_DECLINED;
- }
-
-- rc = njs_vm_prop_name(vm, prop, &key);
-+ rc = njs_vm_prop_name(vm, atom_id, &key);
- if (rc != NJS_OK) {
- njs_value_undefined_set(retval);
- return NJS_DECLINED;
-@@ -266,7 +273,8 @@ nxt_http_js_ext_get_cookie(njs_vm_t *vm, njs_object_pr
-
- static njs_int_t
- nxt_http_js_ext_get_cookie(njs_vm_t *vm, njs_object_prop_t *prop,
-- njs_value_t *value, njs_value_t *setval, njs_value_t *retval)
-+ uint32_t atom_id, njs_value_t *value, njs_value_t *setval,
-+ njs_value_t *retval)
- {
- njs_int_t rc;
- njs_str_t key;
-@@ -280,7 +288,7 @@ nxt_http_js_ext_get_cookie(njs_vm_t *vm, njs_object_pr
- return NJS_DECLINED;
- }
-
-- rc = njs_vm_prop_name(vm, prop, &key);
-+ rc = njs_vm_prop_name(vm, atom_id, &key);
- if (rc != NJS_OK) {
- njs_value_undefined_set(retval);
- return NJS_DECLINED;
-@@ -355,7 +363,8 @@ nxt_http_js_ext_get_var(njs_vm_t *vm, njs_object_prop_
-
- static njs_int_t
- nxt_http_js_ext_get_var(njs_vm_t *vm, njs_object_prop_t *prop,
-- njs_value_t *value, njs_value_t *setval, njs_value_t *retval)
-+ uint32_t atom_id, njs_value_t *value, njs_value_t *setval,
-+ njs_value_t *retval)
- {
- njs_int_t rc;
- njs_str_t key;
-@@ -369,7 +378,7 @@ nxt_http_js_ext_get_var(njs_vm_t *vm, njs_object_prop_
- return NJS_DECLINED;
- }
-
-- rc = njs_vm_prop_name(vm, prop, &key);
-+ rc = njs_vm_prop_name(vm, atom_id, &key);
- if (rc != NJS_OK) {
- njs_value_undefined_set(retval);
- return NJS_DECLINED;