Date: Mon, 6 Jul 2020 02:02:21 +0000 (UTC) From: Wen Heping <wen@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r541309 - head/security/vuxml Message-ID: <202007060202.06622L3x041208@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: wen Date: Mon Jul 6 02:02:20 2020 New Revision: 541309 URL: https://svnweb.freebsd.org/changeset/ports/541309 Log: - Document python37 multiple vulnerabilities Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sun Jul 5 22:16:12 2020 (r541308) +++ head/security/vuxml/vuln.xml Mon Jul 6 02:02:20 2020 (r541309) @@ -58,6 +58,40 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="33c05d57-bf6e-11ea-ba1e-0800273f78d3"> + <topic>Python -- multiple vulnerabilities</topic> + <affects> + <package> + <name>ipython37</name> + <range><lt>3.7.8</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Pytrhon reports:</p> + <blockquote cite="https://docs.python.org/3.7/whatsnew/changelog.html#changelog">; + <p>The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient + regular expression which can be exploited by an attacker to cause a denial of service. + Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben + Caller and Matt Schwager.</p> + <p>Disallow control characters in hostnames in http.client, addressing CVE-2019-18348. + Such potentially malicious header injection URLs now cause a InvalidURL to be raised.</p> + <p>Disallow CR or LF in email.headerregistry.Address arguments to guard against header + injection attacks.</p> + </blockquote> + </body> + </description> + <references> + <url>https://docs.python.org/3.7/whatsnew/changelog.html#changelog</url>; + <cvename>CVE-2019-18348</cvename> + <cvename>CVE-2020-8492</cvename> + </references> + <dates> + <discovery>2019-10-24</discovery> + <entry>2020-07-06</entry> + </dates> + </vuln> + <vuln vid="ae599263-bca2-11ea-b78f-b42e99a1b9c3"> <topic>samba -- Multiple Vulnerabilities</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202007060202.06622L3x041208>