Bug 197449 - [patch] net/rabbitmq: add CPE information
Summary: [patch] net/rabbitmq: add CPE information
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: Jimmy Olgeni
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-02-08 19:14 UTC by shun
Modified: 2015-02-12 10:46 UTC (History)
0 users

See Also:
bugzilla: maintainer-feedback? (olgeni)

Attachments
Makefile with CPE information added (656 bytes, patch)
2015-02-08 19:14 UTC, shun 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description shun 2015-02-08 19:14:50 UTC 
Created attachment 152748 [details]
Makefile with CPE information added

net/rabbitmq has vulnerabilities with a CVE number (CVE-2015-0862)[0]. This patch adds CPE information as suggested in the FreeBSD wiki[1].

[0] http://www.vuxml.org/freebsd/8469d41c-a960-11e4-b18e-bcaec55be5e5.html
[1] https://wiki.freebsd.org/Ports/CPE
Comment 1 Bugzilla Automation freebsd_committer freebsd_triage 2015-02-08 19:14:50 UTC 
Auto-assigned to maintainer olgeni@FreeBSD.org
Comment 2 Jimmy Olgeni freebsd_committer freebsd_triage 2015-02-08 19:28:40 UTC 
Hi,

official-cpe-dictionary_v2.3.xml has "rabbitmq" listed as a
product, but there is no "rabbitmq_management". Maybe CPE_PRODUCT
should be left empty?

This way the CPE_STR would look like the pattern in the CPE dictionary:

$ make -V CPE_STR
cpe:2.3:a:pivotal_software:rabbitmq:3.4.3:::::freebsd10:x64:2
Comment 3 shun 2015-02-08 19:54:47 UTC 
I wondered too, but the CPE product name in CVE-2015-0862 is actually 'rabbitmq_management'[0].

[0] https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0862
Comment 4 commit-hook freebsd_committer freebsd_triage 2015-02-12 10:44:29 UTC 
A commit references this bug:

Author: olgeni
Date: Thu Feb 12 10:43:42 UTC 2015
New revision: 378867
URL: https://svnweb.freebsd.org/changeset/ports/378867

Log:
  Upgrade to version 3.4.4 and set CPE_VENDOR.

  PR:		197449 (CPE)
  Submitted by:	shun

Changes:
  head/net/rabbitmq/Makefile
  head/net/rabbitmq/distinfo
Comment 5 Jimmy Olgeni freebsd_committer freebsd_triage 2015-02-12 10:46:57 UTC 
I only set CPE_VENDOR to match the official naming - seems to be the best match so far. Thanks!