Lapo Luchini reports that run-time dependency on `security/ca_root_nss'
port is no longer needed starting with Golang version 1.17.
Notified by: portscout
I wasn't able to see my mistake based on the error "make validate"
gave me:
Traceback (most recent call last):
File "/usr/local/poudriere/ports/current-patched/security/vuxml/files/extra-validation.py", line 99, in <module>
if (re_invalid_package_name.search(name.text) is not None):
TypeError: expected string or bytes-like object
*** Error code 1
Thanks to Dan for the pointy hat save.
Reported by: Dan Langille
https://github.com/zeek/zeek/releases/tag/v4.0.4
This release fixes two vulnerabilities:
- Paths from log stream make it into system() unchecked, potentially
leading to commands being run on the system unintentionally.
This requires either bad scripting or a malicious package to be
installed, and is considered low severity.
- Fix potential unbounded state growth in the PIA analyzer when
receiving a connection with either a large number of zero-length
packets, or one which continues ack-ing unseen segments. It is
possible to run Zeek out of memory in these instances and cause
it to crash. Due to the possibility of this happening with packets
received from the network, this is a potential DoS vulnerability.
Other fixes:
- The highwayhash submodule was updated to fix a build failure on
FreeBSD 14.
- Packet sources that don't have a selectable file descriptor could
potentially prevent the network time from ever updating, which
would have adverse effects on the primary run loop such as
preventing timers from executing.
- Specific conditions in the run loop could lead RotationTimers
to get into an infinite loop.
- Specially crafted HTTP packets could avoid the HTTP analyzer.
- Zeekctl crashes using the zeekctl status command if the
StatusCmdShowAll option is set to 1 in zeekctl.cfg.
- The ignore_checksum_nets option does not work correctly if
configured with multiple subnets.
Reported by: Tim Wojtulewicz
Security: d4d21998-bdc4-4a09-9849-2898d9b41459
https://github.com/zeek/zeek/releases/tag/v4.0.4
- Paths from log stream make it into system() unchecked, potentially
leading to commands being run on the system unintentionally.
This requires either bad scripting or a malicious package to be
installed, and is considered low severity.
- Fix potential unbounded state growth in the PIA analyzer when
receiving a connection with either a large number of zero-length
packets, or one which continues ack-ing unseen segments. It is
possible to run Zeek out of memory in these instances and cause
it to crash. Due to the possibility of this happening with packets
received from the network, this is a potential DoS vulnerability.
With clang 13, building net-mgmt/pmacct results in a number of warnings:
netflow9.c:2236:25: error: variable 'tot_len' set but not used [-Werror,-Wunused-but-set-variable]
u_int16_t flows = 0, tot_len = 0;
^
In this particular instance, the 'tot_len' variable does not seem to
have any purpose, nor does it have any further side-effects. There is
one more instance of a set but unused variable 'label' in src/sflow.c,
but the code there is also increasing a byte ptr, so it can't easily be
eliminated. For now mark these variables as unused, with an attribute.
Approved by: pi (maintainer)
PR: 258513
MFC: 2021Q3
