From nobody Sat Oct 19 14:58:01 2024 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4XW4ST2zZjz5bB0n; Sat, 19 Oct 2024 14:58:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4XW4ST2GVgz4dDn; Sat, 19 Oct 2024 14:58:01 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1729349881; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dH/++sj6x98dVuKZvYLvF4gUvGd9JFLzj+ktowBw2Uw=; b=TC5XVOOW5D7do33cL8I9ifi9Sk1gbnonyV9AEPQRCU3YmsCIIiChPRz59+L7wtEC3718fx XND32MUWgsYtkeh90D0nZVsnQhfDj0dF1S4B4buVD6NRQh39ihPT/gFUUV7Ayk1mxTXfh1 K7zFvP2aSUeqJZ2H4oTUiqOpCVZvE5CDOj65NIu3nqtfIaNCR+Wli065/U7/GTZt3K/k7e +zL5t6o9QS/U9+/Vks9S7A8xnQnA+ZDMFCwWcBt+nqJ8rU7tclpMRAUDlhiPiLdL1mZFtD CeYoAz15QLbc2I6cJfgFGDXlrbI2T3CQ2PBjdXsQtTD7FiQ39zaLCE83+KtjHA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1729349881; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dH/++sj6x98dVuKZvYLvF4gUvGd9JFLzj+ktowBw2Uw=; b=D6Z+PyRSM/Nhx1OmvgaYMvj4ZtRUkv5jPmBkEE4/tCMKsYbuw16lq8nuLNlEzG0pM45n3K v3JyW2LxqeehUIJ4O5xCWQhEso44wQ2bopFJLUyWJUHaqik+MhtAMi7xyuSagbCBwrv2jW SeQfihJbPmQDa6Z2ohtuE4FQ/bqqlgRFziOWJtLoUGGKHsalBNA3uDBeHZPQt0rKA2x2po iq3cGZSlcjg95j6vpcJSYdQpXKZZ9is17wHpFyfPNebML9HUtysWQ4XwaF4vbHPacuvPwI Ix9PJ1MB/aY+bjlrBdQFoyFNlaYntXCVNUecqHGTUklkVbaZFizxHaQUmox4xg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1729349881; a=rsa-sha256; cv=none; b=FenmlalN1zuIUq9BeO4993fDKRTMZx2tGmLUxLl6+zhikagCXzx/1Xo+EzWmCXXzheDPXa +wb2DDAyh4dfXwqfeCJzCPI6egQiac60T4DwFqCcxt5rIlmbqdQ1gquexHGSJd9+MQgVWr Ky1NqWNpZTrzaKpZavW+NHn6SqH2Xg7KEIo9LoP77acYKScjq/hjlcdAYXV8ILSt6qL5Zf hBfGLmNagNuARtqFc3kWvofjgW17EHR8jJWQb8+ZfsEzHH12c7+dLpoXHIinnDTRVbUCe3 0eWvOzkxNmmJw0afc5VrPw+s6VR0m6fY6IepdkAaAamcMm7LGGUWxwvNIZukzQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4XW4ST1mPRzM96; Sat, 19 Oct 2024 14:58:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 49JEw15d087821; Sat, 19 Oct 2024 14:58:01 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 49JEw1ZA087818; Sat, 19 Oct 2024 14:58:01 GMT (envelope-from git) Date: Sat, 19 Oct 2024 14:58:01 GMT Message-Id: <202410191458.49JEw1ZA087818@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Bernard Spil Subject: git: d0f01687dc3b - main - security/vuxml: Document OpenSSL low vulnerability List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-ports-main@freebsd.org Sender: owner-dev-commits-ports-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: brnrd X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: d0f01687dc3be5b25952ef4a4c9e12cc8dcb0c3f Auto-Submitted: auto-generated The branch main has been updated by brnrd: URL: https://cgit.FreeBSD.org/ports/commit/?id=d0f01687dc3be5b25952ef4a4c9e12cc8dcb0c3f commit d0f01687dc3be5b25952ef4a4c9e12cc8dcb0c3f Author: Bernard Spil AuthorDate: 2024-10-19 14:57:57 +0000 Commit: Bernard Spil CommitDate: 2024-10-19 14:57:57 +0000 security/vuxml: Document OpenSSL low vulnerability --- security/vuxml/vuln/2024.xml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml index ac304d0f7116..43d7593cabda 100644 --- a/security/vuxml/vuln/2024.xml +++ b/security/vuxml/vuln/2024.xml @@ -1,3 +1,33 @@ + + OpenSSL -- OOB memory access vulnerability + + + openssl + 3.0.15_1 + + + + +

The OpenSSL project reports:

+
+

Low-level invalid GF(2^m) parameters lead to OOB memory access + (CVE-2024-9143) (Low)

+

Use of the low-level GF(2^m) elliptic curve APIs with untrusted + explicit values for the field polynomial can lead to out-of-bounds + memory reads or writes.

+
+ + + + CVE-2024-9143 + https://openssl-library.org/news/secadv/20241016.txt + + + 2024-10-16 + 2024-10-19 + + + electron{31,32} -- multiple vulnerabilities