From owner-svn-ports-all@freebsd.org Fri Jul 24 21:38:59 2015 Return-Path: Delivered-To: svn-ports-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id C71E19AA618; Fri, 24 Jul 2015 21:38:59 +0000 (UTC) (envelope-from girgen@FreeBSD.org) Received: from mail.pingpong.net (mail.pingpong.net [79.136.116.202]) by mx1.freebsd.org (Postfix) with ESMTP id 850021B12; Fri, 24 Jul 2015 21:38:59 +0000 (UTC) (envelope-from girgen@FreeBSD.org) Received: from [10.0.1.9] (h-85-24-195-121.na.cust.bahnhof.se [85.24.195.121]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.pingpong.net (Postfix) with ESMTPSA id C601BB1ED; Fri, 24 Jul 2015 23:38:51 +0200 (CEST) Subject: Re: svn commit: r392739 - branches/2015Q2/security/vuxml Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2102\)) Content-Type: multipart/signed; boundary="Apple-Mail=_5E2EEE63-F3B4-49B9-BB90-52B8579A597A"; protocol="application/pgp-signature"; micalg=pgp-sha256 X-Pgp-Agent: GPGMail 2.5 From: Palle Girgensohn In-Reply-To: <1437756844.2148972.332341833.7702303E@webmail.messagingengine.com> Date: Fri, 24 Jul 2015 23:38:51 +0200 Cc: Brad Davis , ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-branches@freebsd.org Message-Id: <9A468FE8-4FB1-4781-B21E-D16444233D80@FreeBSD.org> References: <201507231624.t6NGOPAZ039747@repo.freebsd.org> <20150724162312.GO94853@valentine.liquidneon.com> <1437756844.2148972.332341833.7702303E@webmail.messagingengine.com> To: Mark Felder X-Mailer: Apple Mail (2.2102) X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2015 21:38:59 -0000 --Apple-Mail=_5E2EEE63-F3B4-49B9-BB90-52B8579A597A Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii > 24 jul 2015 kl. 18:54 skrev Mark Felder : >=20 >=20 >=20 > On Fri, Jul 24, 2015, at 11:23, Brad Davis wrote: >> On Thu, Jul 23, 2015 at 04:24:25PM +0000, Palle Girgensohn wrote: >>> Author: girgen >>> Date: Thu Jul 23 16:24:25 2015 >>> New Revision: 392739 >>> URL: https://svnweb.freebsd.org/changeset/ports/392739 >>>=20 >>> Log: >>> Shibboleth SP software crashes on well-formed but invalid XML. >>>=20 >>> The Service Provider software contains a code path with an uncaught >>> exception that can be triggered by an unauthenticated attacker by >>> supplying well-formed but schema-invalid XML in the form of SAML >>> metadata or SAML protocol messages. The result is a crash and so >>> causes a denial of service. >>>=20 >>> You must rebuild opensaml and shibboleth with xmltooling-1.5.5 or = later. >>> The easiest way to do so is to update the whole chain including >>> shibboleth-2.5.5 an opensaml2.5.5. >>>=20 >>> URL: = http://shibboleth.net/community/advisories/secadv_20150721.txt >>> Security: CVE-2015-2684 >>> Approved by: ports-secteam >>>=20 >>> Modified: >>> branches/2015Q2/security/vuxml/vuln.xml >>=20 >> Shouldn't this have gone into HEAD? I thought vuln.xml was only used = in >> head, not from the branches. >>=20 >=20 > And not even the current branch... That's weird. >=20 > Can we get old branches locked down a bit further? Umm, sorry, my mistake, I had the 2015Q2 branch checked out, and just = entierly missed it. I will merge to HEAD as I write... :-/ --Apple-Mail=_5E2EEE63-F3B4-49B9-BB90-52B8579A597A Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBCAAGBQJVsrBrAAoJEIhV+7FrxBJD7EYH/3RBjdp3COKn/EfZgg+Y+YWm jEEYDL/8LjINmOzHeh9uNM/U45KFeqdNopHYDi7NPozsY2Ko26ZJ/JCWrSporcbE hkrLag0m+oDWBTqFEcOlfeqY1+RmRpiFZsagwomHTPa1qeJVlRsRRmV0SBf6TO0p 2ydduXqvkpJM4veRSdrN+bI4jl/ZdPR77b0RmWtQs6HqThyv7vsMaU3pgYWHMtrY h7+ud574Pk/odFj7lrtyfZa1RQmw4o7zDpi5M7Gy/YLFok56kdbz6ONzEptATf0v jneJwepV+uGuYcLT3AjJixH2o5OATNOl5LpAQcl93o7MnBqvhXJkKTeXBg7cMFM= =A5kk -----END PGP SIGNATURE----- --Apple-Mail=_5E2EEE63-F3B4-49B9-BB90-52B8579A597A--