security/vuxml 1.1_6

security/vuxml: Document vulnerabilities in databases/mantis

PR:		257068
Reported by:	Zoltan ALEXANDERSON BESSE <zab@zltech.eu>

security/vuxml: Document gitlab vulnerability

security/vuxml: document vulnerabilities in graphics/exiv2

PR:	256803

security/vuxml: document openexr < 3.0.5 vulns

Security:	f2596f27-db4c-11eb-8bc6-c556d71493c9

security/vuxml: Documented gitlab vulnerabilities.

security/vuxml: Let vuln-flat.xml depend on all vuln xml files

So it can get rebuilt when any of vuln xml file changed.

Approved by:	ports-secteam (fluffy, implicitly)

security/vuxml: Document Jenkins Security Advisory 2021-06-30

Sponsored by:	The FreeBSD Foundation

security/vuxml: Fix dovecot entry

Fix stray ">" character in a CVE URL.

security/vuxml: Add net/rabbitmq CVE-2021-22116 DoS vuln

Security:	CVE-2021-22116
Sponsored by:	SkunkWerks, GmbH

security/vuxml: Pet rabbitmq-c entry

make clean validate failed after rebased commit
fix package name error and indentation issues

security/vuxml: Pet puppetdb entry

make clean validate reports a missing stanza

security/vuxml:  add entry for net/rabbitmq-c

Sponsored by:   SkunkWerks, GmbH
Security:       CVE-2019-18609
Differential Revision: https://reviews.freebsd.org/D30906

security/vuxml: Document CVE-2021-27021

security/vuxml: Add another package for CVE-2021-3583

Also, fix a copy-paste error. py*-ansible-base are listed twice. The
second entry should list py*-ansible instead.

security/vuxml: Update Ansible's CVE-2021-3583

It turns out that it affects not only ansible-core, but also some other
ports.

security/vuxml: Fix mail/dovecot-pigeonhole vulnerable versions

Correct mail/dovecot-pigeonhole vulnerable versions to proper value.

security/vuxml: Fix CVS name for vid e4cd0b38-c9f9-11eb-87e1-08002750c711

This should fix vuxml.org build.

PR:		256789

security/vuxml: Update the doc link and the comment of where to add new entry

Approved by:	ports-secteam (implicitly)

security/vuxml: Document sysutils/py-ansible-core vulnerability

Security:	CVE-2021-3583

security/vuxml: Fix `make validate` to use the latest vuxml file

This is a follow up for 6954792fe916862afd25cf6ce961bd7062dfb21f

Approved by:	ports-secteam (fluffy)

security/vuxml: Create 2021 entity

Let's create a new entity in the beginning of each year and append to it,
instead of massive copying in the end of each year.

security/vuxml: Fix version range of www/py-aiohttp

This also marks 3.7.4.p0 as fixed.

PR:	256219

security/vuxml: Document mail/dovecot-pigeonhole vulnerability

security/vuxml: Document mail/dovecot vulnerabilities

security/vuxml: Fix range for www/nginx CVE-2021-23017

Reviewed by:	garga
Sponsored by:	Rubicon Communications, LLC ("Netgate")

security/vuxml: Fix 'make validate'

While here, remove hyperlinks to simplify, they can be accessed through
the report's url.

security/vuxml: Add entry for gitea < 1.14.3

PR:		256720

security/vuxml: Add www/chromium < 91.0.4472.114

Obtained from:	https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-desktop_17.html

security/vuxml: Document CVE-2021-29376 for irc/ircII

PR:		255492
Reported by:	Andrew Gierth <andrew@tao11.riddles.org.uk>

security/vuxml: Document Apache httpd vulns

security/vuxml: document CVE-2021-33564 for rubygem-dragonfly

security/vuxml: Document CVE-2020-35701 for net-mgmt/cacti

security/vuxml: add Chromium < 91.0.4472.101

Obtained from:	https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-desktop.html

security/vuxml: Document CVE-2021-33896 in net-im/dino port

security/vuxml: Document CVE-2021-3515 for databases/pglogical

A shell injection flaw was found in pglogical in versions before 2.3.4
and before 3.6.26. An attacker with CREATEDB privileges on a
PostgreSQL server can craft a database name that allows execution of
shell commands as the postgresql user when calling
pglogical.create_subscription().

security/vuxml: add www/drupal7 CVE

security/vuxml: document vulnerability in sysutils/polkit

Cedric Buissart reports:

	The function `polkit_system_bus_name_get_creds_sync` is used to get the
	uid and pid of the process requesting the action. It does this by
	sending the unique bus name of the requesting process, which is
	typically something like ":1.96", to `dbus-daemon`. These unique names
	are assigned and managed by `dbus-daemon` and cannot be forged, so this
	is a good way to check the privileges of the requesting process.

	The vulnerability happens when the requesting process disconnects from
	`dbus-daemon` just before the call to
	`polkit_system_bus_name_get_creds_sync` starts. In this scenario, the
	unique bus name is no longer valid, so `dbus-daemon` sends back an error
	reply. This error case is handled in
	`polkit_system_bus_name_get_creds_sync` by setting the value of the
	`error` parameter, but it still returns `TRUE`, rather than `FALSE`.
	This behavior means that all callers of
	`polkit_system_bus_name_get_creds_sync` need to carefully check whether
	an error was set. If the calling function forgets to check for errors
	then it will think that the uid of the requesting process is 0 (because
	the `AsyncGetBusNameCredsData` struct is zero initialized). In other
	words, it will think that the action was requested by a root process,
	and will therefore allow it.

PR:		256405
Security:	CVE-2021-3560 polkit

security/vuxml: Document CVE-2021-33054 for www/sogo*.

PR:		256374
Reported by:	rob2g2 <spam123@bitbert.com>

security/vuxml: Add CVE-2020-8492 for lang/tauthon

PR: 256387
Reported by:	olivier.freebsd@free.fr

security/vuxml: Document CVE-2021-28091 for security/lasso.

PR:		256373
Reported by:	spam123@bitbert.com

security/vuxml: Document lang/go vulnerabilities

security/vuxml: document aiohttp CVE-2021-21330

security/vuxml: Mark zeek < 4.0.2 as vulnerable as per:

https://github.com/zeek/zeek/releases/tag/v4.0.2

 - Fix potential Undefined Behavior in decode_netbios_name() and
   decode_netbios_name_type() BIFs. The latter has a possibility
   of a remote heap-buffer-overread, making this a potential DoS
   vulnerability.

 - Add some extra length checking when parsing mobile ipv6 packets.
   Due to the possibility of reading invalid headers from remote
   sources, this is a potential DoS vulnerability.

security/vuxml: add entry for PyYAML CVE-2020-14343

PR:		256220

security/vuxml: Fix overly large entry that violates 'make validate'

security/vuxml: Document isc-dhcp44-* vulnerability

PR:		256377

security/vuxml: Document gitlab vulnerabilities.

security/vuxml: Correct CVE entry for the x11/libX11 vulnerability

security/vuxml: document vulnerability in databases/redis

Security:	CVE-2021-32625

security/vuxml: Document vulnerability in x11/libX11

PR:		256034
Security:	CVE-2021-31535