openssl-1.0.2.13

[Dirk Meyer]

Hallo Gerard Seibert,

> I have a question regarding "openssl-1.0.2.13". Since the port is
> marked as "vulnerable", I was wondering if there is any idea when a
> corrected port will be released?

openssl-1.0.2.13 is the fixed port.

> Also, according to the documentation on
> https://vuxml.FreeBSD.org/freebsd/6f0529e2-2e82-11e6-b2ec-b499baebfeaf.html
> this only affects versions of openssl < 1.0.2_13
> 
> Affected packages
> 		openssl 	< 	1.0.2_13
> 0 	<= 	openssl-devel
> 		libressl 	< 	2.3.6
> 		libressl-devel 	< 	2.4.1
> 
> I am not an expert on this, so perhaps I am misinterpreting this data.

You are correct,
but your system uses an older (cached) version of the vuxml file.

Please update your cache with:
pkg audit -F

kind regards Dirk

- Dirk Meyer, Im Grund 4, 34317 Habichtswald, Germany
- [dirk.meyer at dinoex.sub.org],[dirk.meyer at guug.de],[dinoex at FreeBSD.org]