git: 2986f76a6403 - main - security/vuxml: Mark zeek < 5.0.7 as vulnerable as per:
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Tue, 21 Feb 2023 22:38:05 UTC
The branch main has been updated by leres:
URL: https://cgit.FreeBSD.org/ports/commit/?id=2986f76a640307b7b182d06950ae9ac15be172c6
commit 2986f76a640307b7b182d06950ae9ac15be172c6
Author: Craig Leres <leres@FreeBSD.org>
AuthorDate: 2023-02-21 22:37:24 +0000
Commit: Craig Leres <leres@FreeBSD.org>
CommitDate: 2023-02-21 22:37:24 +0000
security/vuxml: Mark zeek < 5.0.7 as vulnerable as per:
https://github.com/zeek/zeek/releases/tag/v5.0.7
This release fixes the following potential DoS vulnerabilities:
- Receiving DNS responses from async DNS requests (via the
lookup_addr, etc BIF methods) with the TTL set to zero could
cause the DNS manager to eventually stop being able to make new
requests.
- Specially-crafted FTP packets with excessively long usernames,
passwords, or other fields could cause log writes to use large
amounts of disk space.
- The find_all and find_all_ordered BIF methods could take extremely
large amounts of time to process incoming data depending on the
size of the input.
Reported by: Tim Wojtulewicz
---
security/vuxml/vuln/2023.xml | 34 ++++++++++++++++++++++++++++++++++
1 file changed, 34 insertions(+)
diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml
index a85e7e41451c..84b6afb7bb69 100644
--- a/security/vuxml/vuln/2023.xml
+++ b/security/vuxml/vuln/2023.xml
@@ -1,3 +1,37 @@
+ <vuln vid="7a425536-74f7-4ce4-9768-0079a9d44d11">
+ <topic>zeek -- potential DoS vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>zeek</name>
+ <range><lt>5.0.7</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Tim Wojtulewicz of Corelight reports:</p>
+ <blockquote cite="https://github.com/zeek/zeek/releases/tag/v5.0.6">
+ <p> Receiving DNS responses from async DNS requests (via
+ the lookup_addr, etc BIF methods) with the TTL set to
+ zero could cause the DNS manager to eventually stop being
+ able to make new requests. </p>
+ <p> Specially-crafted FTP packets with excessively long
+ usernames, passwords, or other fields could cause log
+ writes to use large amounts of disk space. </p>
+ <p> The find_all and find_all_ordered BIF methods could
+ take extremely large amounts of time to process incoming
+ data depending on the size of the input. </p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <url>https://github.com/zeek/zeek/releases/tag/v5.0.7</url>
+ </references>
+ <dates>
+ <discovery>2023-02-21</discovery>
+ <entry>2023-02-21</entry>
+ </dates>
+ </vuln>
+
<vuln vid="421c0af9-b206-11ed-9fe5-f4a47516fb57">
<topic>libde256 -- multiple vulnabilities</topic>
<affects>