From nobody Sun Feb 19 11:02:32 2023 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4PKN1N4jnGz3klHq; Sun, 19 Feb 2023 11:02:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4PKN1N3sCGz48rc; Sun, 19 Feb 2023 11:02:32 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1676804552; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=k9GrgLAGA9WUKwur7uCK/7WxjPUm/vsJdoSaAuwmS24=; b=WojDu86THcKMjWxpgidImlHDeldY7b9qMoVfLeJ2rjbbTzGmrt6Au9A3h4/cmFKBDsIThH u0xzCl/gEk7HW8HHikZl4YYPNjxhWTcdcE7v7gw+ma3S/koSo7846vcPRim14vzAZhRrjd MK0CkZm/9cV61snot9RkeOXAM6LlzdOiwZrLOv8EiEP8pmGbFTiqbKZ7UOg8gO3ARbMG6q 7sbaXRSInfPI2XPA+TNr49DybWaTwnpW6cOwuV0ZUhRcKUQWN8PBUPH1AgAARmot29H2Xq DNvfr7Q6Kl8si7bjP/AR2D1sHlDCAo+EnmmgGlyz+dzDz6g4U2pd/bUAp0XXDg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1676804552; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=k9GrgLAGA9WUKwur7uCK/7WxjPUm/vsJdoSaAuwmS24=; b=dFmfydUowYUuTGDLt8GhOlv5cOiKuMTYJ4YxvXzWsnF6z1U6LaopPcfuppxZPHghOvA5W0 /uB1YG6XEeLOrEV1orpl5wskIWbWnlD1n8GHnfJjXszJffKxfHGMihH4Ysa0Px+Y2YjThM SGiJjtUSty2z2XZxkHRAfY1NTqQEEzvYV7/aP3DfTzAGhbTjXb94jb4Svz2AoCfeFtGaJ5 GcwmtHVxdNeP810oIk+XI4f/Piees5nhuoJsWfjTMJCA5TRI7xdo7w7F8giUL6JYWpfAJT bv3HnC+xrHQrpvDPl7AGRLtgrPefaW3pmavEdwxJNFeeQMYYkMXpkwDBhJj64g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1676804552; a=rsa-sha256; cv=none; b=D5BfdOEIwZSUPtohbroWQIzMfkA+Rmxk/wX0Zds1U8qGtDPVJLvF5JlYXRkyoaoilUn2j2 dhDECoTVzxW93nt7jdy9O2byWEMPB4HykPn7kKhc1HxYWmHP2BLMsQ4aQ/4qXmUuYi8gnY ePwKGVZnMcO34LuNAeKx+8ESBlROfcaIGLtsmgN9EkUIf51Zj+8RZo6o5kUVDIc/BKcUV8 2wUJIDX6ZOHeV7q+JFWzqNZItLnEuEYlerlCW0tYb3/xc85CY0diXE7MMrDaoMPZ1W24Vd x+ZXgxHGY0BnXYPb3dIBBRLQqPZ4W9u66YN0EwxZEcEQUcHEu1afTye8uts3Gw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4PKN1N2ltPz10LM; Sun, 19 Feb 2023 11:02:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 31JB2W3q052777; Sun, 19 Feb 2023 11:02:32 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 31JB2WjG052776; Sun, 19 Feb 2023 11:02:32 GMT (envelope-from git) Date: Sun, 19 Feb 2023 11:02:32 GMT Message-Id: <202302191102.31JB2WjG052776@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Robert Clausecker Subject: git: 31b0c7cc1e13 - main - security/vuxml: document log4j vulnerability in sysutils/rundeck3 List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-main@freebsd.org X-BeenThere: dev-commits-ports-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: fuz X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 31b0c7cc1e13a427686091324534a59738f54712 Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by fuz: URL: https://cgit.FreeBSD.org/ports/commit/?id=31b0c7cc1e13a427686091324534a59738f54712 commit 31b0c7cc1e13a427686091324534a59738f54712 Author: Robert Clausecker AuthorDate: 2023-02-16 09:45:40 +0000 Commit: Robert Clausecker CommitDate: 2023-02-19 11:01:41 +0000 security/vuxml: document log4j vulnerability in sysutils/rundeck3 PR: 261748 Reported by: ruben@verweg.com Approved by: flo (mentor) Differential Revision: https://reviews.freebsd.org/D38636 --- security/vuxml/vuln/2023.xml | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml index b68b0725e4c5..c8906a95fa1b 100644 --- a/security/vuxml/vuln/2023.xml +++ b/security/vuxml/vuln/2023.xml @@ -1,3 +1,30 @@ + + Rundeck3 -- Log4J RCE vulnerability + + + rundeck3 + 3.4.10 + + + + +

The Rundeck project reports:

+
+

This release updates both Community and Enterprise with the latest Log4J + to address CVE-2021-44832 by updating it to 2.17.1.

+
+ + + + CVE-2021-44832 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44832 + + + 2021-12-11 + 2023-02-16 + + + MinIO -- unprivileged users can create service accounts for admin users