mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2025-01-15 07:56:36 +00:00
Code Issues Releases Activity

- Update puppet to 3.2.2 which fixes CVE-2013-3567 [1]

Browse Source 
- Update puppet27 to 2.7.22 which fixes CVE-2013-3567
- Document security issue

PR:		ports/179816 [1]
Submitted by:	mat [1]
Security:	b162b218-c547-4ba2-ae31-6fdcb61bc763
This commit is contained in:
Steve Wills 2013-06-22 12:49:28 +00:00
parent d3f0fcf533
commit 94d8197109
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=321570
6 changed files with 49 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
security/vuxml/vuln.xml
View File

@ -51,6 +51,41 @@ Note: Please add new entries to the beginning of this file.
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="b162b218-c547-4ba2-ae31-6fdcb61bc763">
<topic>puppet -- Unauthenticated Remote Code Execution Vulnerability</topic>
<affects>
<package>
<name>puppet</name>
<range><lt>3.2.2</lt></range>
</package>
<package>
<name>puppet27</name>
<range><ge>2.7</ge><lt>2.7.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Puppet Developers report:</p>
<blockquote cite="http://puppetlabs.com/security/cve/cve-2013-3567/">
<p>When making REST api calls, the puppet master takes YAML from an
untrusted client, deserializes it, and then calls methods on the
resulting object. A YAML payload can be crafted to cause the
deserialization to construct an instance of any class available in
the ruby process, which allows an attacker to execute code
contained in the payload.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-3567</cvename>
</references>
<dates>
<discovery>2013-06-13</discovery>
<entry>2013-06-22</entry>
</dates>
</vuln>
<vuln vid="8b97d289-d8cf-11e2-a1f5-60a44c524f57">
<topic>otrs -- information disclosure</topic>
<affects>

8
sysutils/puppet/Makefile
View File

@ -2,8 +2,7 @@
# $FreeBSD$
PORTNAME= puppet
PORTVERSION= 3.1.1
PORTREVISION= 2
PORTVERSION= 3.2.2
CATEGORIES= sysutils
MASTER_SITES= http://downloads.puppetlabs.com/puppet/
@ -41,11 +40,14 @@ MAN8= extlookup2hiera.8 puppet-agent.8 puppet-apply.8 puppet-ca.8 \
puppet-resource_type.8 puppet-secret_agent.8 puppet-status.8 \
puppet.8
OPTIONS_DEFINE= MONGREL PACKAGE_ORIGIN PACKAGE_ROOT
OPTIONS_DEFINE= MONGREL
OPTIONS_DEFAULT= PACKAGE_ORIGIN
OPTIONS_SINGLE= PATCHES
OPTIONS_SINGLE_PATCHES= PACKAGE_ORIGIN PACKAGE_ROOT
MONGREL_DESC= Run puppet server as a mongrel service
PACKAGE_ORIGIN_DESC= Use port origin as package name
PACKAGE_ROOT_DESC= Use PACKAGEROOT insted of PACKAGESITE
PATCHES_DESC= Optional exclusive patches
.include <bsd.port.options.mk>

4
sysutils/puppet/distinfo
View File

@ -1,2 +1,2 @@
SHA256 (puppet-3.1.1.tar.gz) = 4401f6388bb96b1301a107f247af6fa558127d78467bb5cef1a1e0ff66b4463d
SIZE (puppet-3.1.1.tar.gz) = 1587190
SHA256 (puppet-3.2.2.tar.gz) = c47745aa73912b2cb1a20b07e8741b8af37a920b9bc8dc8afb14b23d8df7d13d
SIZE (puppet-3.2.2.tar.gz) = 1784340

11
sysutils/puppet/files/patch-service-freebsd.rb
View File

@ -1,11 +0,0 @@
--- lib/puppet/provider/service/freebsd.rb.orig 2013-04-28 02:55:36.017584743 +0000
+++ lib/puppet/provider/service/freebsd.rb 2013-04-28 02:55:52.581583782 +0000
@@ -41,7 +41,7 @@
def rcvar_name
name = self.rcvar[1]
self.error("No rcvar name found in rcvar") if name.nil?
- name = name.gsub!(/(.*)(_enable)?=(.*)/, '\1')
+ name = name.gsub!(/(.*?)(_enable)?=(.*)/, '\1')
self.error("rcvar name is empty") if name.nil?
self.debug("rcvar name is #{name}")
name

8
sysutils/puppet27/Makefile
View File

@ -2,8 +2,7 @@
# $FreeBSD$
PORTNAME= puppet
PORTVERSION= 2.7.21
PORTREVISION= 1
PORTVERSION= 2.7.22
CATEGORIES= sysutils
MASTER_SITES= http://downloads.puppetlabs.com/puppet/
@ -43,11 +42,14 @@ MAN8= filebucket.8 pi.8 puppet-agent.8 puppet-apply.8 puppet-ca.8 \
puppet.8 puppetca.8 puppetd.8 puppetdoc.8 puppetmasterd.8 \
puppetqd.8 puppetrun.8 ralsh.8
OPTIONS_DEFINE= MONGREL PACKAGE_ORIGIN PACKAGE_ROOT
OPTIONS_DEFINE= MONGREL
OPTIONS_DEFAULT= PACKAGE_ORIGIN
OPTIONS_SINGLE= PATCHES
OPTIONS_SINGLE_PATCHES= PACKAGE_ORIGIN PACKAGE_ROOT
MONGREL_DESC= Run puppet server as a mongrel service
PACKAGE_ORIGIN_DESC= Use port origin as package name
PACKAGE_ROOT_DESC= Use PACKAGEROOT insted of PACKAGESITE
PATCHES_DESC= Optional exclusive patches
.include <bsd.port.options.mk>

4
sysutils/puppet27/distinfo
View File

@ -1,2 +1,2 @@
SHA256 (puppet-2.7.21.tar.gz) = c18b426457d023e87745f0a98b7dd257f8e94722b5b0d3cafb6048ef2499273f
SIZE (puppet-2.7.21.tar.gz) = 1998848
SHA256 (puppet-2.7.22.tar.gz) = bfd79c0aecdeea4e1a8573e9325fbcb48778603d908180e88897458f01fe06de
SIZE (puppet-2.7.22.tar.gz) = 2023230