security/vuxml 1.1_6

Um, ok.  Third attempt to try to fix the vuxml build.

Sponsored by:	Rubicon Communications, LLC (netgate.com)

Attempt number 2 to fix the vuxml build.

Sponsored by:	Rubicon Communications, LLC (netgate.com)

Fix vuxml build.

Sponsored by:	Rubicon Communications, LLC (netgate.com)

security/vuxml: Fix OpenSSL port commit

security/vuxml: Mark OpenSSL 1.1.1f from ports vulnerable too

Document libntlm vulnerability

Add new entries for SA-20:10 and SA-20:11.

security/vuxml: Document devel/py-twisted vulnerabilities

PR:		245252
Submitted by:	Sascha Biberhofer <ports@skyforge.at>
Reported by:	contact@evilham.com

security/vuxml: Add CVE-2020-1730 affecting security/libssh

Approved by:	gerald (mentor)
Differential Revision:	https://reviews.freebsd.org/D24377

Document webkit2-gtk3 vulnability

- Add www/drupal8 entry

sysutils/ansible*: Add multiple Vulnerabilities

- Add vuxml entry for CVE-2020-1737, CVE-2020-1739 and CVE-2020-1740

Security:       CVE-2020-1737
Security:       CVE-2020-1739
Security:       CVE-2020-1740

Document new vulnerabilities in www/chromium < 81.0.4044.113

Obtained from:	Google Chrome Releases

document security/openvpn{,-mbedtls,-devel} illegal client float DoS

URL:		https://community.openvpn.net/openvpn/ticket/1272

Reported by:	Lev Stipakov
Security:	CVE-2020-11810
Security:	8604121c-7fc2-11ea-bcac-7781e90b0c8f

Document Mbed TLS CVE-2020-10932.

Security:	https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-04

Document gitlab vulnerabilities.

security/vuxml: Mark zeek < 3.0.4 as vulnerable as per:

https://github.com/zeek/zeek/blob/e059d4ec2e689b3c8942f4aa08b272f24ed3f612/NEWS

An attacker can crash Zeek remotely via crafted packet sequence via
a stack overflow in POP3 analyzer.

Document new vulnerabilities in www/chromium < 81.0.4044.92

Document partial new vulnerabilities in www/chromium < 80.0.3987.162

Add an entry for the HAproxy vulnerability announced today. The ports have already been fixed.

PR:		245282
Discussed with:	demon

Fix rubygem-json entry (40194e1c-6d89-11ea-8082-80ee73419af3)

rubygem-json 2.3.0 was erroneously marked as vulnerable.

% cd /usr/ports/devel/rubygem-json
% make fetch
===>  rubygem-json-2.3.0 has known vulnerabilities:
rubygem-json-2.3.0 is vulnerable:
rubygem-json -- Unsafe Objection Creation Vulnerability in JSON (Additional fix)
CVE: CVE-2020-10663
WWW: https://vuxml.FreeBSD.org/freebsd/40194e1c-6d89-11ea-8082-80ee73419af3.html

1 problem(s) in 1 installed package(s) found.
=> Please update your ports tree and try again.
=> Note: Vulnerable ports are marked as such even if there is no update available.
=> If you wish to ignore this vulnerability rebuild with 'make DISABLE_VULNERABILITIES=yes'
*** Error code 1

Stop.
make: stopped in /usr/ports/devel/rubygem-json

Add entry for Apache 2.4

Sponsored by:	Netzkommune GmbH

Document multiple vulnerabilities in net-mgmt/cacti < 1.2.10

PR:		245205
Submitted by:	Michael Muenz <m.muenz@gmail.com>

Add entry for GNUTLS-SA-2020-03-31 (flaw in DTLS).

Security:	https://gnutls.org/security-new.html#GNUTLS-SA-2020-03-31

Fix validation error

Add vuxml entry for CVE-2020-1720

- Document mediawiki's multiple vulnerabilities

Fix vuxml build.

Sponsored by:	Rubicon Communications, LLC (netgate.com)

Document gitlab vulnerabilities.

security/vuxml: Document CVE-2020-10663 (devel/rubygem-json)

PR:		245023

Document Jenkins Security Advisory 2020-03-25

Sponsored by:	The FreeBSD Foundation

Add entry for phpmyadmin

Sponsored by:	Netzkommune GmbH

Add details for two Puppet-related CVEs

Add details for today's SAs.

Approved by:	so

security/vuxml: Add www/py-bleach entry

security/vuxml: Mark zeek < 3.0.3 as vulnerable as per:

https://raw.githubusercontent.com/zeek/zeek/9dda3602a760f00d9532c6314ea79108106033fa/NEWS

There are a number of potential denial of service issues due to
memory leaks, buffer overflows, and a null pointer dereference.

Approved by:	matthew (mentor, implicit)

scurity/vuxml: fix range

Document security issue in graphics/okular

https://kde.org/info/security/advisory-20200312-1.txt:

Overview
========
Okular can be tricked into executing local binaries via specially crafted
PDF files.

This binary execution can require almost no user interaction.

No parameters can be passed to those local binaries.

We have not been able to identify any binary that will cause actual damage,
be it in the hardware or software level, when run without parameters.

We remain relatively confident that for this issue to do any actual damage,
it has to run a binary specially crafted. That binary must have been deployed
to the user system via another method, be it the user downloading it directly
as an email attachment, webpage download, etc. or by the system being already
compromised.

Solution
========
- Update to Okular >= 1.10.0
- or apply the following patch:
https://invent.kde.org/kde/okular/-/commit/6a93a033b4f9248b3cd4d04689b8391df754e244

Workaround
==========
There's no real workaround other than not opening PDF files from untrusted sources.

Credits
=======
Thanks to Mickael Karatekin from Sysdream Labs for the discovery and to
Albert Astals Cid for the fix.

Document gitlab-ce vulnerability.

- Document django's potential SQL injection vulnerability

Document py-matrix-synapse vulnerabilities

PR:		244279
Submitted by:	Sascha Biberhofer <ports@skyforge.at>

security/vuxml: document recent Node.js vulnerabilities

https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/

While here, fix errors from `make validate` for the preceeding gitea
vulnerabilities.

Sponsored by:	Miles AS

Fix closing tag

Reported by:	joneum

Add entry for www/gitea

PR:		244025
Submitted by:	maintainer

Document vulnerability in sysutils/py-salt

PR:		243908
Reported by:	Christer Edwards <christer.edwards@gmail.com>
Security:	CVE-2019-17361

Documment gitlab vulnerabilities.

Document the latest nwtime.org ntp security advisory found at: http://support.ntp.org/bin/view/Main/SecurityNotice#\ March_2020_ntp_4_2_8p14_NTP_Rele

No CVEs have been documented yet.

Security:	http://support.ntp.org/bin/view/Main/NtpBug3610
		http://support.ntp.org/bin/view/Main/NtpBug3596
		http://support.ntp.org/bin/view/Main/NtpBug3592

Document librsvg2 vulnabilities.

Security:	CVE-2019-20446

Document some audio/timidity++* vulnerabilities

PR:		244429
Reported by:	pi
Security:	CVE-2017-11546
Security:	CVE-2017-11547
Security:	CVE-2017-11549

Document apache-solr vulnerabilities.