From nobody Fri Dec 20 14:14:22 2024 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4YF8YW14L4z5McJ2; Fri, 20 Dec 2024 14:14:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4YF8YW0Zlqz4jVg; Fri, 20 Dec 2024 14:14:23 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1734704063; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=XnqHVVy8UVFKtmCdRYThxq9YjWsPw5cE7W+juVt47wU=; b=H36ARkAHuKzFUa45qmfKVVizjKRrD8iUVZS7+/U8/0wr51UG9RAG0KDJnLvRXE/VQ43fQm fE+pv5yx3kpAG3SQyZzeooUU7yeeWylKKr8YvFw0eevqv+1suHHFPZlm2zW6QnAzXyyUsz J/Uz5pQYcB69Ck34NCBp00zIhCxwS9nhuKJFH6w4HUlbd1uTYO0g1jjmqmZvIujA+8wWxz u4lMB7Q0uTCykemJ7PFKuLZBctMUOKFlGyr6I1M5uxAvNe+iSML0HRZkWXAMGEaJrqcAth g/Tkue6Ta1spc8vYlFKbwxjzHkELY3THP7Vu12GFd8XTDPwhhL8U4W9jDoIfoQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1734704063; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=XnqHVVy8UVFKtmCdRYThxq9YjWsPw5cE7W+juVt47wU=; b=JrIWt51/8NZ174Z0BhA/BRsT9RPPPHSqQ/0gCx30JG3NWNg0EFdn+NeHimJ/uP4ZSCsnmP psq0eR+xc+l25cci5swL3EbYL1n/QFWP8nJ7mmpaBONLEwAnL4YLbFdTr9/4ae9+nMB3uZ uePlmONvtiD87PoWezNxDYkSEpcU7q9XbtDQg1XoqmTmzNbWa0eJRW6Bbdxx+seJ0AurGR xzE1QYp5T4TWyERfyplKg4FFdwRrJ3oGf1fyiJkmTKq0PVDwrF2Lx4TyTl/H5GNYsEOsyF 9DKo80g5SU6U5+bkmdU3A8P0uIYSmtiPV2tXsaqmP6PXWwGS/faTP8ziWIib0Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1734704063; a=rsa-sha256; cv=none; b=bba3nNiRPCIzTwZbVtQdXZfL8fhAclDHRlT3wP3V8zI/R/97+sxyzirHNtj2VyWkS0+OPm XC1iylHDF9iek8G9xwtwDVDMxVtut1Chb98sr92wxb4UIvBGXAQHPb38Z7Z5ewwv65pWfB auSCsXEfP6Gf5KvxWpADsRh2thnjYyvi2ezb6D3AUUclW7bYo+aLjKaVJq389ReK9Fj01P 1LFbjsVEGw2bEuLpi4k8C4yGKVPWBBHa7RZ1xDyiFQKHW+YPgnKlvihNxyIq9J0oUabTWN r7Tc32nuhkKEcefP9vm8pVy/TMxvqMzzmwUbHrPoQMsl6ycDjEFxybc/jJ2ONQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4YF8YW09JjzhNT; Fri, 20 Dec 2024 14:14:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 4BKEEMrZ057655; Fri, 20 Dec 2024 14:14:22 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 4BKEEM7H057652; Fri, 20 Dec 2024 14:14:22 GMT (envelope-from git) Date: Fri, 20 Dec 2024 14:14:22 GMT Message-Id: <202412201414.4BKEEM7H057652@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Bernard Spil Subject: git: d3c7341ee3d6 - main - security/vuxml: Document Vaultwarden vulnerability List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-ports-all@freebsd.org Sender: owner-dev-commits-ports-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: brnrd X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: d3c7341ee3d6fde45278a0b335062856d5ae9783 Auto-Submitted: auto-generated The branch main has been updated by brnrd: URL: https://cgit.FreeBSD.org/ports/commit/?id=d3c7341ee3d6fde45278a0b335062856d5ae9783 commit d3c7341ee3d6fde45278a0b335062856d5ae9783 Author: Bernard Spil AuthorDate: 2024-12-20 14:14:19 +0000 Commit: Bernard Spil CommitDate: 2024-12-20 14:14:19 +0000 security/vuxml: Document Vaultwarden vulnerability --- security/vuxml/vuln/2024.xml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml index 55a68cead9cf..044dfb47cf91 100644 --- a/security/vuxml/vuln/2024.xml +++ b/security/vuxml/vuln/2024.xml @@ -1,3 +1,28 @@ + + Vaultwarden -- Admin organization permissions + + + vaultwarden + 1.32.7 + + + + +

The Vaultwarden project reports:

+
+

Admins from any organization were able to modify or delete groups in any other organization if they know the group's uuid.

+
+ + + + https://github.com/dani-garcia/vaultwarden/pull/5291 + + + 2024-12-20 + 2024-12-20 + + + chromium -- multiple security fixes