pkg/60615: doc/pkg-vulnerabilities: bound more open-ended glob entries
"Showta Ishizaki via gnats" <[email protected]>
| Newsgroups | gmane.os.netbsd.devel.pkgsrc.bugs |
|---|---|
| Message-ID | <[email protected]> |
>Number: 60615 >Category: pkg >Synopsis: doc/pkg-vulnerabilities: bound more open-ended glob entries >Confidential: no >Severity: non-critical >Priority: medium >Responsible: pkg-manager >State: open >Class: doc-bug >Submitter-Id: net >Arrival-Date: Mon Aug 17 15:35:02 +0000 2026 >Originator: Showta Ishizaki >Release: NetBSD 10.1 / pkgsrc doc/pkg-vulnerabilities rev 1.779 >Organization: >Environment: System: NetBSD bambi.snowrabbit.org 10.1 NetBSD 10.1 (GENERIC) #0: Mon Dec 16 13:08:11 UTC 2024 [email protected]:/usr/src/sys/arch/i386/compile/GENERIC i386 Architecture: i386 Machine: i386 >Description: More entries of the kind fixed in rev 1.776-1.778 and PR pkg/60610: patterns left open-ended after upstream fixed the issue, so "pkg_admin audit" keeps flagging every later version forever. These are the unbounded "pkg-[0-9]*" glob form; each bound below was verified against the upstream advisory or fix commit: - opencc<1.1.2 (CVE-2018-16982): fix commit 4a4f9e58, first contained in ver.1.1.2. - opencc<1.2.0 (CVE-2025-15536): fix commit 345c9a50, first contained in ver.1.2.0 (no 1.1.10 exists). - roundup<1.6.1 (CVE-2019-10904): Roundup CHANGES.txt, 1.6.1 (2019-07-13): "fix XSS issue in wsgi and cgi when handling url not found/404" (issue2551035, same reporter/issue as the CVE record). - mediawiki / CVE-2019-16738: expanded to <1.31.4, >=1.32<1.32.4, >=1.33<1.33.1 per the 2019-10-07 security release announcement. - mediawiki / CVE-2019-19709: expanded to <1.31.6, >=1.32<1.32.6, >=1.33<1.33.2 per the 2019-12-19 security release announcement. - moodle / CVE-2022-0984 and CVE-2022-0985: expanded to <3.9.13, >=3.10<3.10.10, >=3.11<3.11.6 per the Moodle security announcements. - py{...}-cleo>=1.0.0alpha1<1.0.0 (CVE-2022-42966): the vulnerable regex is present in all of 1.0.0a1..a5 and the fix commit b5b9a04d is first contained in 1.0.0 final; the GHSA "fixed in 2.0.0" claim conflates the two releases made hours apart on 2022-11-22. (The "alpha1" spelling matters: in dewey terms 1.0.0alpha1 sorts below 1.0.0, while a literal "1.0.0a1" would sort above it.) - podman<4.4.2 (CVE-2023-0778). - py{...}-octoprint<1.10.0rc1 (CVE-2024-23637). - py{...}-test<9.0.3 (CVE-2025-71176). - py{...}-orjson<3.11.6 (CVE-2025-67221). - py{...}-protobuf<5.29.6 and >=6.30.0rc1<6.33.5 (CVE-2026-0994), covering both affected branches. Thanks as always for the prompt handling of these reports. >How-To-Repeat: e.g. "git tag --contains 4a4f9e58" in BYVoid/OpenCC lists ver.1.1.2 as the earliest release containing the fix; the mediawiki/moodle branch bounds match the respective security release announcements. >Fix: Apply the following patch (against rev 1.779): --- pkg-vulnerabilities.cvshead 2026-08-17 16:35:32 +++ pkg-vulnerabilities.1779.batchA 2026-08-18 00:32:10 @@ -15877,7 +15877,7 @@ dnsdist<1.2.0 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2016-7069 radare2<2.9.0 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2018-15834 gitolite<3.6.9 access-bypass https://nvd.nist.gov/vuln/detail/CVE-2018-16976 -opencc-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2018-16982 +opencc<1.1.2 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2018-16982 tor-browser<8.0 unspecified https://nvd.nist.gov/vuln/detail/CVE-2018-16983 php<5.6.38 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2018-17082 php>=7.0<7.0.32 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2018-17082 @@ -17146,7 +17146,7 @@ teeworlds<0.7.3 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2019-10877 teeworlds<0.7.3 out-of-bounds-write https://nvd.nist.gov/vuln/detail/CVE-2019-10878 teeworlds<0.7.3 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2019-10879 -roundup-[0-9]* cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2019-10904 +roundup<1.6.1 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2019-10904 py{27,34,35,36,37,38}-jinja2<2.8.1 sandbox-escape https://nvd.nist.gov/vuln/detail/CVE-2016-10745 py{27,34,35,36,37,38}-jinja2<2.10.1 sandbox-escape https://nvd.nist.gov/vuln/detail/CVE-2019-10906 php{56,70,71,72,73}-roundcube-plugin-enigma-[0-9]* sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2019-10740 @@ -18120,7 +18120,9 @@ libgcrypt<1.8.5 sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2019-13627 glpi<9.4.4 authentication-bypass https://nvd.nist.gov/vuln/detail/CVE-2019-14666 ruby{22,24,25,26}-zip<1.3.0 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2019-16892 -mediawiki-[0-9]* information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2019-16738 +mediawiki<1.31.4 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2019-16738 +mediawiki>=1.32<1.32.4 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2019-16738 +mediawiki>=1.33<1.33.1 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2019-16738 mbedtls<2.19.0 side-channel https://nvd.nist.gov/vuln/detail/CVE-2019-16910 libreoffice<6.3.1 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2019-9853 exim>=4.92<4.92.3 remote-code-execution https://nvd.nist.gov/vuln/detail/CVE-2019-16928 @@ -18584,7 +18586,9 @@ go-dns<1.1.25 insufficiently-random-numbers https://nvd.nist.gov/vuln/detail/CVE-2019-19794 knot<4.3.0 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2019-19331 libspiro-[0-9]* stack-overflow https://nvd.nist.gov/vuln/detail/CVE-2019-19847 -mediawiki-[0-9]* security-bypass https://nvd.nist.gov/vuln/detail/CVE-2019-19709 +mediawiki<1.31.6 security-bypass https://nvd.nist.gov/vuln/detail/CVE-2019-19709 +mediawiki>=1.32<1.32.6 security-bypass https://nvd.nist.gov/vuln/detail/CVE-2019-19709 +mediawiki>=1.33<1.33.2 security-bypass https://nvd.nist.gov/vuln/detail/CVE-2019-19709 nethack-lib<3.6.4 privilege-escalation https://nvd.nist.gov/vuln/detail/CVE-2019-19905 py{27,34,35,36,37,38}-django>=1.11<1.11.27 account-impersonation https://nvd.nist.gov/vuln/detail/CVE-2019-19844 py{34,35,36,37,38}-django>=2.1<2.1.15 account-impersonation https://nvd.nist.gov/vuln/detail/CVE-2019-19844 @@ -23388,8 +23392,12 @@ py{27,36,37,38,39,310}-httpx-[0-9]* input-validation https://nvd.nist.gov/vuln/detail/CVE-2021-41945 podman<3.4.7 code-execution https://nvd.nist.gov/vuln/detail/CVE-2022-1227 ImageMagick>=7.1<7.1.0.28 use-after-free https://nvd.nist.gov/vuln/detail/CVE-2022-1114 -moodle-[0-9]* authentication-bypass https://nvd.nist.gov/vuln/detail/CVE-2022-0985 -moodle-[0-9]* authentication-bypass https://nvd.nist.gov/vuln/detail/CVE-2022-0984 +moodle<3.9.13 authentication-bypass https://nvd.nist.gov/vuln/detail/CVE-2022-0985 +moodle>=3.10<3.10.10 authentication-bypass https://nvd.nist.gov/vuln/detail/CVE-2022-0985 +moodle>=3.11<3.11.6 authentication-bypass https://nvd.nist.gov/vuln/detail/CVE-2022-0985 +moodle<3.9.13 authentication-bypass https://nvd.nist.gov/vuln/detail/CVE-2022-0984 +moodle>=3.10<3.10.10 authentication-bypass https://nvd.nist.gov/vuln/detail/CVE-2022-0984 +moodle>=3.11<3.11.6 authentication-bypass https://nvd.nist.gov/vuln/detail/CVE-2022-0984 qemu<7.0.0 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2021-4207 qemu<7.0.0 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2021-4206 mediawiki<1.36.4 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2022-28323 @@ -24691,7 +24699,7 @@ py{27,36,37,38,39,310,311}-Pillow<9.3.0 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2022-45199 py{27,36,37,38,39,310,311}-Pillow<9.2.0 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2022-45198 py{27,36,37,38,39,310,311}-certifi>=2017.11.05<2022.12.07 improper-certificate-validation https://nvd.nist.gov/vuln/detail/CVE-2022-23491 -py{27,36,37,38,39,310,311}-cleo-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2022-42966 +py{27,36,37,38,39,310,311}-cleo>=1.0.0alpha1<1.0.0 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2022-42966 py{27,36,37,38,39,310,311}-cryptography>=1.8<39.0.1 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2023-23931 py{27,36,37,38,39,310,311}-gitpython<3.1.30 remote-code-execution https://nvd.nist.gov/vuln/detail/CVE-2022-24439 py{27,36,37,38,39,310,311}-ipython<8.10.0 arbitrary-command-injection https://nvd.nist.gov/vuln/detail/CVE-2023-24816 @@ -25479,7 +25487,7 @@ grpc>=1.53.0<1.55.0 expected-behavior-violation https://nvd.nist.gov/vuln/detail/CVE-2023-32731 grpc>=1.51.0<1.53.0 expected-behavior-violation https://nvd.nist.gov/vuln/detail/CVE-2023-1428 grpc<1.55.3 expected-behavior-violation https://nvd.nist.gov/vuln/detail/CVE-2023-4785 -podman-[0-9]* unknown-impact https://nvd.nist.gov/vuln/detail/CVE-2023-0778 +podman<4.4.2 unknown-impact https://nvd.nist.gov/vuln/detail/CVE-2023-0778 opensc-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2023-2977 opensc<0.23.0 stack-overflow https://nvd.nist.gov/vuln/detail/CVE-2021-34193 jhead<3.08 out-of-bounds-write https://nvd.nist.gov/vuln/detail/CVE-2022-28550 @@ -25834,7 +25842,7 @@ mbedtls<2.28.7 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2024-23775 mbedtls>=3<3.5.2 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2024-23775 opensc-[0-9]* sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2023-5992 -py{27,37,38,39,310,311,312}-octoprint-[0-9]* sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2024-23637 +py{27,37,38,39,310,311,312}-octoprint<1.10.0rc1 sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2024-23637 glpi<10.0.12 code-injection https://nvd.nist.gov/vuln/detail/CVE-2023-51446 glpi<10.0.12 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2024-23645 graphviz<10 out-of-bounds-read https://nvd.nist.gov/vuln/detail/CVE-2023-46045 @@ -29411,7 +29419,7 @@ firefox140<140.7 multiple-vulnerabilities https://www.mozilla.org/en-US/security/advisories/mfsa2026-03/ thunderbird<147 multiple-vulnerabilities https://www.mozilla.org/en-US/security/advisories/mfsa2026-04/ thunderbird140<140.7 multiple-vulnerabilities https://www.mozilla.org/en-US/security/advisories/mfsa2026-05/ -opencc-[0-9]* out-of-bounds-read https://nvd.nist.gov/vuln/detail/CVE-2025-15536 +opencc<1.2.0 out-of-bounds-read https://nvd.nist.gov/vuln/detail/CVE-2025-15536 assimp-[0-9]* use-after-free https://nvd.nist.gov/vuln/detail/CVE-2025-15538 ImageMagick<7.1.2.13 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2026-22770 ImageMagick<7.1.2.13 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2026-23874 @@ -29508,7 +29516,7 @@ python314-[0-9]* input-validation https://nvd.nist.gov/vuln/detail/CVE-2025-12781 ImageMagick<7.1.2.13 null-pointer-dereference https://nvd.nist.gov/vuln/detail/CVE-2026-23952 ImageMagick6<6.9.13.38 null-pointer-dereference https://nvd.nist.gov/vuln/detail/CVE-2026-23952 -py{27,310,311,312,313,314}-test-[0-9]* insecure-temporary-files https://nvd.nist.gov/vuln/detail/CVE-2025-71176 +py{27,310,311,312,313,314}-test<9.0.3 insecure-temporary-files https://nvd.nist.gov/vuln/detail/CVE-2025-71176 py{27,310,311,312,313,314}-wheel<0.46.2 path-traversal https://nvd.nist.gov/vuln/detail/CVE-2026-24049 7-zip<25.00 path-traversal https://nvd.nist.gov/vuln/detail/CVE-2025-11002 avahi-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2026-24401 @@ -29530,8 +29538,9 @@ nodejs22-[0-9]* command-injection https://nvd.nist.gov/vuln/detail/CVE-2026-0775 nodejs24-[0-9]* command-injection https://nvd.nist.gov/vuln/detail/CVE-2026-0775 nodejs-[0-9]* command-injection https://nvd.nist.gov/vuln/detail/CVE-2026-0775 -py{27,310,311,312,313,314}-orjson-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-67221 -py{27,310,311,312,313,314}-protobuf-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2026-0994 +py{27,310,311,312,313,314}-orjson<3.11.6 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-67221 +py{27,310,311,312,313,314}-protobuf<5.29.6 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2026-0994 +py{27,310,311,312,313,314}-protobuf>=6.30.0rc1<6.33.5 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2026-0994 python310-[0-9]* invalid-validation https://nvd.nist.gov/vuln/detail/CVE-2026-1299 python311-[0-9]* invalid-validation https://nvd.nist.gov/vuln/detail/CVE-2026-1299 python312-[0-9]* invalid-validation https://nvd.nist.gov/vuln/detail/CVE-2026-1299