git: bfee83e3a0be - main - security/vuxml: Record rpm4 vulnerability.
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Thu, 01 Dec 2022 14:14:43 UTC
The branch main has been updated by rodrigo:
URL: https://cgit.FreeBSD.org/ports/commit/?id=bfee83e3a0be489b8e54d647ca4d1add4cf5c9be
commit bfee83e3a0be489b8e54d647ca4d1add4cf5c9be
Author: Rodrigo Osorio <rodrigo@FreeBSD.org>
AuthorDate: 2022-12-01 13:39:16 +0000
Commit: Rodrigo Osorio <rodrigo@FreeBSD.org>
CommitDate: 2022-12-01 14:03:36 +0000
security/vuxml: Record rpm4 vulnerability.
Add multiple CVE fixed in latest rpm4 version.
PR: 267291
---
security/vuxml/vuln/2022.xml | 29 +++++++++++++++++++++++++++++
1 file changed, 29 insertions(+)
diff --git a/security/vuxml/vuln/2022.xml b/security/vuxml/vuln/2022.xml
index 4c9d6d9874e1..67c3a41de84f 100644
--- a/security/vuxml/vuln/2022.xml
+++ b/security/vuxml/vuln/2022.xml
@@ -1,3 +1,32 @@
+ <vuln vid="0c52abde-717b-11ed-98ca-40b034429ecf">
+ <topic>rpm4 -- Multiple Vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>rpm4</name>
+ <range><lt>4.18.0</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>rpm project reports:</p>
+ <blockquote cite="https://rpm.org/wiki/Releases/4.18.0">
+ <p>Fix intermediate symlinks not verified (CVE-2021-35939).</p>
+ <p>Fix subkey binding signatures not checked on PGP public keys (CVE-2021-3521).</p>
+ <p>Refactor file and directory operations to use fd-based APIs throughout (CVE-2021-35938)</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2021-35939</cvename>
+ <cvename>CVE-2021-3521</cvename>
+ <cvename>CVE-2021-35938</cvename>
+ </references>
+ <dates>
+ <discovery>2022-08-22</discovery>
+ <entry>2022-12-01</entry>
+ </dates>
+ </vuln>
+
<vuln vid="3cde510a-7135-11ed-a28b-bff032704f00">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>