svn commit: r547499 - head/security/gnupg

[Adam Weinberger]

Author: adamw
Date: Fri Sep  4 02:12:38 2020
New Revision: 547499
URL: https://svnweb.freebsd.org/changeset/ports/547499

Log:
  security/gnupg: Update to 2.2.23
  
  Importing an OpenPGP key having a preference list for AEAD algorithms
  will lead to an array overflow and thus often to a crash or other
  undefined behaviour.
  
  Importing an arbitrary key can often easily be triggered by an attacker
  and thus triggering this bug.  Exploiting the bug aside from crashes is
  not trivial but likely possible for a dedicated attacker.  The major
  hurdle for an attacker is that only every second byte is under their
  control with every first byte having a fixed value of 0x04.
  
  Software distribution verification should not be affected by this bug
  because such a system uses a curated list of keys.
  
  MFH:		2020Q3
  Security:	CVE-2020-25125

Modified:
  head/security/gnupg/Makefile
  head/security/gnupg/distinfo

Modified: head/security/gnupg/Makefile
==============================================================================
--- head/security/gnupg/Makefile	Fri Sep  4 02:06:26 2020	(r547498)
+++ head/security/gnupg/Makefile	Fri Sep  4 02:12:38 2020	(r547499)
@@ -1,7 +1,7 @@
 # $FreeBSD$
 
 PORTNAME=	gnupg
-PORTVERSION=	2.2.22
+PORTVERSION=	2.2.23
 CATEGORIES=	security
 MASTER_SITES=	GNUPG
 
@@ -31,6 +31,7 @@ CONFIGURE_ARGS=	--disable-ntbtls --enable-gpg-is-gpg2 
 GNU_CONFIGURE=	yes
 INFO=		gnupg
 TEST_TARGET=	check
+TEST_ARGS=	TESTARGS=--parallel
 
 SUB_FILES=	pkg-message
 

Modified: head/security/gnupg/distinfo
==============================================================================
--- head/security/gnupg/distinfo	Fri Sep  4 02:06:26 2020	(r547498)
+++ head/security/gnupg/distinfo	Fri Sep  4 02:12:38 2020	(r547499)
@@ -1,3 +1,3 @@
-TIMESTAMP = 1598556721
-SHA256 (gnupg-2.2.22.tar.bz2) = 7c1370565e1910b9d8c4e0fb57b9de34aa062ec7bb91abad5803d791f38d855b
-SIZE (gnupg-2.2.22.tar.bz2) = 7098444
+TIMESTAMP = 1599184354
+SHA256 (gnupg-2.2.23.tar.bz2) = 10b55e49d78b3e49f1edb58d7541ecbdad92ddaeeb885b6f486ed23d1cd1da5c
+SIZE (gnupg-2.2.23.tar.bz2) = 7099806