CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

databases/metabase0.58.24

Simple and powerful analytics tool that supports multiple data stores

5
unaddressed
0
VuXML only, still affected
1
fixed
Maintainer
daniel@morante.net
Packages
metabase 0.58.24
Upstream
Higher version available: 0.64.1
CPE
metabase:metabase from the port
WWW
https://metabase.com/
Links
cgit · VuXML

Unaddressed (5) · The CVE record lists this version as affected, no VuXML entry names the CVE

Updating to 1.57.13 would fix 5 of 5 unaddressed CVEs, according to the CVE records.
Fixed up to each version, cumulative: 1.43.7.2 1 · 1.43.7.3 2 · 1.54.22 3 · 1.55.13 4 · 1.57.13 5
CVE-2023-3747010.02023-08-04Metabase is an open-source business intelligence and analytics platform. Prior to versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3, 1.45.4.3, and 1.46…
CVE-2023-386469.82023-07-21Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level…
CVE-2026-274647.72026-02-21Metabase is an open-source data analytics platform. In versions prior to 0.57.13 and versions 0.58.x through 0.58.6, authenticated users are able to retrieve sensitive i…
CVE-2026-337257.22026-03-27Metabase is an open source business intelligence and embedded analytics tool. In Metabase Enterprise prior to versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, and 1…
CVE-2026-228052.12026-01-12Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that allow users to create subscriptions could be pote…

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (1)

Show 1 fixed
VuXML entries whose affected range this version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVE-2026-7289810.02026-08-10Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Met…

Commits (10)

Vladimir Druzenko (vvd) · 0.58.24
databases/metabase: Update 0.55.4.1 => 0.58.24

Announcement:
https://www.metabase.com/releases/metabase-58

PR:		297333
Approved by:	Daniel Morante <daniel@morante.net> (maintainer)
Security:	GHSA-vwf4-m7j8-wcjf
Sponsored by:	UNIS Labs
MFH:		2026Q3
c3fd848c44
Ronald Klop (ronald) · 0.55.4.1_2
*/*: bump portrevision after java_default=25 update

Included all ports that have USES=java.

PR:	293559
86813e9ccf
Ronald Klop (ronald) · 0.55.4.1_1
*/*: bump portrevision after java_default=21 update

PR:	272855
2baaf16375
Vladimir Druzenko (vvd) · 0.55.4.1
databases/metabase: Update 0.41.5 => 0.55.4.1

Announcement:
https://www.metabase.com/releases/metabase-55

While here replace PORTVERSION with DISTVERSION.

PR:		287636
Approved by:	Daniel Morante <daniel@morante.net> (maintainer)
Co-authored-by:	filis
338db6a0b4
Muhammad Moinur Rahman (bofh) · 0.41.5
Mk/**java.mk: Convert bsd.java.mk to USES

The following features have been added or changed:
- Instead of USE_JAVA use USES=java. This defaults to
  USES=java:build,run if NO_BUILD is undefined. Else it defaults to
  USES=java:run
- Instead of USE_ANT=yes use USES=java:ant which also implies
  USES=java:build
- Instead of JAVA_BUILD=yes use USES=java:build. Does not imply run or
  extract
- Instead of JAVA_EXTRACT=yes use USES=java:extract does not imply
  build or run
- Instead of JAVA_RUN=yes use USES=java:run does not imply extract or
  build
- Instead of USE_JAVA=<version> use USES=java and JAVA_VERSION=<version>

Approved by: mat (portmgr), glewis
Differential Revision:  https://reviews.freebsd.org/D48201
0835676e36
Stefan Eßer (se) · 0.41.5
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 0.41.5
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Fernando Apesteguía (fernape) · 0.41.5
databases/metabase: update to 0.41.5

Includes log4j security fix

PR:	261001
Reported by:	marco+freebsd@crowdsec.net
Approved by:	daniel@morante.net (maintainer, implicit)
MFH:	2022Q1
e49e8e5d00
Bernhard Froehlich (decke) · 0.40.1
databases/metabase: Add CPE information

Approved by:    portmgr (blanket)
d8c8cc7b49
Li-Wen Hsu (lwhsu) · 0.40.1
databases/metabase: (New) Simple and powerful analytics tool that supports multiple data stores

PR:		257304
71a09abcf5