git: 201deb9bea6f - main - security/vuxml: Add qpress vulnerability CVE-2022-45866

From: Oleksii Samorukov <samm_at_FreeBSD.org>
Date: Tue, 06 Jun 2023 20:10:47 UTC 
The branch main has been updated by samm:

URL: https://cgit.FreeBSD.org/ports/commit/?id=201deb9bea6f64e46e89ee322cd603e561b6e8c7

commit 201deb9bea6f64e46e89ee322cd603e561b6e8c7
Author:     Oleksii Samorukov <samm@FreeBSD.org>
AuthorDate: 2023-06-06 20:08:55 +0000
Commit:     Oleksii Samorukov <samm@FreeBSD.org>
CommitDate: 2023-06-06 20:10:27 +0000

    security/vuxml: Add qpress vulnerability CVE-2022-45866
---
 security/vuxml/vuln/2023.xml | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml
index e3c3b60d42f9..3d44651a7b0e 100644
--- a/security/vuxml/vuln/2023.xml
+++ b/security/vuxml/vuln/2023.xml
@@ -1,3 +1,31 @@
+  <vuln vid="2f38c6a2-04a4-11ee-8cb0-e41f13b9c674">
+    <topic>qpress -- directory traversal</topic>
+    <affects>
+      <package>
+	<name>qpress</name>
+	<range><lt>11.3</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>cve@mitre.org reports:</p>
+	<blockquote cite="https://github.com/EvgeniyPatlan/qpress/commit/ddb312090ebd5794e81bc6fb1dfb4e79eda48761">
+	  <p>qpress before PierreLvx/qpress 20220819 and before version 11.3,
+	as used in Percona XtraBackup and other products, allows directory
+	traversal via ../ in a .qp file.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2022-45866</cvename>
+      <url>https://nvd.nist.gov/vuln/detail/CVE-2022-45866</url>
+    </references>
+    <dates>
+      <discovery>2022-11-23</discovery>
+      <entry>2023-06-06</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="bfca647c-0456-11ee-bafd-b42e991fc52e">
     <topic>Kanboard -- Multiple vulnerabilities</topic>
     <affects>