Re: python312 CVE-2025-15366 CVE-2025-15367

Hi Sha'ul,

Am 11.08.26 um 21:16 schrieb Sha'ul:
> Are these known CVEs causing the block from building port?
> 
> $ doas git -C /usr/ports pull
> Password:
> Already up to date.
> $ doas portmaster -a
> Password:
> ===>>> Starting check of installed ports for available updates
> ===>>> Launching child to update python312-3.12.13_3 to python312-3.12.13_4
> 
> ===>>> All >> python312-3.12.13_3 (1/1)
> 
> ===>>> Currently installed version: python312-3.12.13_3
> ===>>> Port directory: /usr/ports/lang/python312
> 
> ===>>> Launching 'make checksum' for lang/python312 in background
> ===>>> Gathering dependency list for lang/python312 from ports
> ===>>> Initial dependency check complete for lang/python312
> 
> ===>>> Returning to update check of installed ports
> 
> 
> ===>>> All >> (1)
> 
> ===>>> The following actions will be taken if you choose to proceed:
>          Upgrade python312-3.12.13_3 to python312-3.12.13_4
> 
> ===>>> Proceed? y/n [y]
> 
> 
> ===>>> Starting build for ports that need updating <<<===
> 
> ===>>> Launching child to install lang/python312
> 
> ===>>> All >> lang/python312 (1/1)
> 
> ===>>> Currently installed version: python312-3.12.13_3
> ===>>> Port directory: /usr/ports/lang/python312
> 
> ===>>> Starting check for build dependencies
> ===>>> Gathering dependency list for lang/python312 from ports
> ===>>> Dependency check complete for lang/python312
> 
> ===>>> All >> python312-3.12.13_3 (1/1)
> 
> ===>  Cleaning for python312-3.12.13_4
> ===>  python312-3.12.13_4 has known vulnerabilities:
> python312-3.12.13_4 is vulnerable:
>    Python -- poplib module, when passed a user-controlled command, can 
> have additional commands injected using newlines
>    CVE: CVE-2025-15367
>    WWW: https://vuxml.FreeBSD.org/ 
> freebsd/6d3488ae-2e0f-11f1-88c7-00a098b42aeb.html
> 
>    Python -- imaplib module, when passed a user-controlled command, can 
> have additional commands injected using newlines
>    CVE: CVE-2025-15366
>    WWW: https://vuxml.FreeBSD.org/ 
> freebsd/0be929a5-2e0f-11f1-88c7-00a098b42aeb.html
> 
> 2 problem(s) in 1 package(s) found.
> => Please update your ports tree and try again.
> => Note: Vulnerable ports are marked as such even if there is no update 
> available.
> => If you wish to ignore this vulnerability rebuild with 'make 
> DISABLE_VULNERABILITIES=yes'
> *** Error code 1
> 
> Stop.
> make[1]: stopped making "/tmp/ports/usr/ports/lang/python312/ 
> work/.build_done.python._usr_local" in /usr/ports/lang/python312
> *** Error code 1
> 
> Stop.
> make: stopped making "build" in /usr/ports/lang/python312
> 
> ===>>> make build failed for lang/python312
> ===>>> Aborting update
> 
> ===>>> Update for lang/python312 failed
> ===>>> Aborting update
> 
> 
> ===>>> You can restart from the point of failure with this command line:
>         portmaster <flags> lang/python312
> 

This happens, because the default setting is DISABLE_VULNERABILITIES=no, 
so portmaster has to stop at such ports.

You can circumstance this with the following call:

portmaster -m 'DISABLE_VULNERABILITIES=yes' lang/python312

HTH,
Rainer