From owner-svn-ports-head@freebsd.org Wed Jun 24 20:35:40 2015
Return-Path:
Delivered-To: svn-ports-head@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
[IPv6:2001:1900:2254:206a::19:1])
by mailman.ysv.freebsd.org (Postfix) with ESMTP id 7647D915924;
Wed, 24 Jun 2015 20:35:40 +0000 (UTC)
(envelope-from delphij@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(Client did not present a certificate)
by mx1.freebsd.org (Postfix) with ESMTPS id 57CA71650;
Wed, 24 Jun 2015 20:35:40 +0000 (UTC)
(envelope-from delphij@FreeBSD.org)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id t5OKZeOb066598;
Wed, 24 Jun 2015 20:35:40 GMT (envelope-from delphij@FreeBSD.org)
Received: (from delphij@localhost)
by svn.freebsd.org (8.14.9/8.14.9/Submit) id t5OKZexk066596;
Wed, 24 Jun 2015 20:35:40 GMT (envelope-from delphij@FreeBSD.org)
Message-Id: <201506242035.t5OKZexk066596@svn.freebsd.org>
X-Authentication-Warning: svn.freebsd.org: delphij set sender to
delphij@FreeBSD.org using -f
From: Xin LI
Date: Wed, 24 Jun 2015 20:35:40 +0000 (UTC)
To: ports-committers@freebsd.org, svn-ports-all@freebsd.org,
svn-ports-head@freebsd.org
Subject: svn commit: r390519 - head/security/vuxml
X-SVN-Group: ports-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-ports-head@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: SVN commit messages for the ports tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Wed, 24 Jun 2015 20:35:40 -0000
Author: delphij
Date: Wed Jun 24 20:35:39 2015
New Revision: 390519
URL: https://svnweb.freebsd.org/changeset/ports/390519
Log:
Split CVE-2015-4152 to its own entry as the affected port is logstash only.
While there also document CVE-2014-4326 (already fixed) for logstash.
PR: ports/201001
Submitted by: Jason Unovitch
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Wed Jun 24 20:27:20 2015 (r390518)
+++ head/security/vuxml/vuln.xml Wed Jun 24 20:35:39 2015 (r390519)
@@ -57,8 +57,81 @@ Notes:
-->
+
+ logstash -- Directory traversal vulnerability in the file output plugin
+
+
+ logstash
+ 1.4.3
+
+
+
+
+ Elastic reports:
+
+ An attacker could use the File output plugin with dynamic field
+ references in the path option to traverse paths outside of Logstash
+ directory. This technique could also be used to overwrite any files
+ which can be accessed with permissions associated with Logstash
+ user. This release sandboxes the paths which can be traversed using
+ the configuration. We have also disallowed use of dynamic field
+ references if the path options is pointing to an absolute path.
+ We have added this vulnerability to our CVE page and are working
+ on filling out the CVE. We would like to thank Colin Coghill for
+ reporting the issue and working with us on the resolution.
+
+
+
+
+ CVE-2015-4152
+ https://www.elastic.co/blog/logstash-1-4-3-released
+ https://www.elastic.co/community/security
+
+
+ 2015-06-09
+ 2015-06-24
+
+
+
+
+ logstash -- Remote command execution in Logstash zabbix and nagios_nsca outputs
+
+
+ logstash
+ 1.4.2
+
+
+
+
+ Elastic reports:
+
+ The vulnerability impacts deployments that use the either the
+ zabbix or the nagios_nsca outputs. In these cases, an attacker
+ with an ability to send crafted events to any source of data for
+ Logstash could execute operating system commands with the
+ permissions of the Logstash process.
+ Deployments that do not use the zabbix or the nagios_nsca outputs
+ are not vulnerable and do not need to upgrade for this reason.
+ We have added this vulnerability to our CVE page and are working
+ on filling out the CVE.
+ We would like to thank Jan Karwowski and Danila Borisiuk for
+ reporting the issue and working with us on the resolution.
+
+
+
+
+ CVE-2014-4326
+ https://www.elastic.co/blog/logstash-1-4-2
+ https://www.elastic.co/community/security
+
+
+ 2014-06-24
+ 2015-06-24
+
+
+
- logstash-forwarder and logstash -- multiple vulnerabilities
+ logstash-forwarder and logstash -- susceptibility to POODLE vulnerability
logstash-forwarder
@@ -80,15 +153,6 @@ Notes:
are working on filling out the CVE.
Thanks to Tray Torrance, Marc Chadwick, and David Arena for
reporting this.
- An attacker could use the File output plugin with dynamic
- field references in the path option to traverse paths outside
- of Logstash directory. This technique could also be used to
- overwrite any files which can be accessed with permissions
- associated with Logstash user. This release sandboxes the
- paths which can be traversed using the configuration.
- We have also disallowed use of dynamic field references
- if the path options is pointing to an absolute path.
- [CVE-2015-4152].
SSLv3 is no longer supported; TLS 1.0+ is required (compatible
@@ -98,7 +162,6 @@ Notes:
- CVE-2015-4152
ports/201065
ports/201065
https://www.elastic.co/blog/logstash-1-4-3-released
@@ -107,6 +170,7 @@ Notes:
2015-06-09
2015-06-24
+ 2015-06-24