svn commit: r494705 - head/security/vuxml

Tue Mar 5 15:00:55 UTC 2019

Author: 0mp
Date: Tue Mar  5 15:00:54 2019
New Revision: 494705
URL: https://svnweb.freebsd.org/changeset/ports/494705

Log:
  Document a slixmpp < 1.4.1 vulnerability
  
  Reviewed by:	krion, mat
  Approved by:	krion (mentor), mat (mentor)
  MFH:		2019Q1

Modified:
  head/security/vuxml/vuln.xml

Modified: head/security/vuxml/vuln.xml
==============================================================================

--- head/security/vuxml/vuln.xml	Tue Mar  5 14:32:21 2019	(r494704)
+++ head/security/vuxml/vuln.xml	Tue Mar  5 15:00:54 2019	(r494705)
@@ -58,6 +58,43 @@ Notes:
   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="526d9642-3ae7-11e9-a669-8c164582fbac">
+    <topic>slixmpp -- improper access control</topic>
+    <affects>
+      <package>
+	<name>py35-slixmpp</name>
+	<name>py36-slixmpp</name>
+	<name>py37-slixmpp</name>
+	<range><lt>1.4.2</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>NVD reports:</p>
+	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2019-1000021">
+	  <p>slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416
+	    contains an incorrect Access Control vulnerability in XEP-0223 plugin
+	    (Persistent Storage of Private Data via PubSub) options profile, used
+	    for the configuration of default access model that can result in
+	    all of the contacts of the victim can see private data having been
+	    published to a PEP node. This attack appears to be exploitable
+	    if the user of this library publishes any private data on PEP,
+	    the node isn't configured to be private. This vulnerability appears
+	    to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416
+	    which is included in slixmpp 1.4.2.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <url>https://nvd.nist.gov/vuln/detail/CVE-2019-1000021</url>
+      <cvename>CVE-2019-1000021</cvename>
+    </references>
+    <dates>
+      <discovery>2019-02-04</discovery>
+      <entry>2019-03-05</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="11292460-3f2f-11e9-adcb-001b217b3468">
     <topic>Gitlab -- Multiple vulnerabilities</topic>
     <affects>
