Bug 260854 - devel/ghidra: Outdated and vulnerable to RCE
Summary: devel/ghidra: Outdated and vulnerable to RCE
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: freebsd-ports-bugs (Nobody)
URL:
Keywords: needs-patch
Depends on:
Blocks:
 
Reported: 2022-01-01 02:52 UTC by Cameron Katri
Modified: 2024-02-06 21:28 UTC (History)
3 users (show)

See Also:
bugzilla: maintainer-feedback? (sghctoma)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Cameron Katri 2022-01-01 02:52:38 UTC 
The ghidra port is still on 9.1 while the current version is 10.1.1. It is easy to gain remote code execution in ghidra by loading a malicious binary, which is the main use-case for ghidra.
Comment 1 Fernando Apesteguía freebsd_committer freebsd_triage 2022-02-23 09:40:12 UTC 
Doesn't this affect only Windows systems?

https://github.com/NationalSecurityAgency/ghidra/issues/286

Cheers.
Comment 2 Cameron Katri 2022-02-23 13:12:01 UTC 
I was talking about Log4Shell, here's a proof of concept https://github.com/zhuowei/GhidraLog4Shell. But 9.1 is still an older version, even if you ignore the security vulnerabilities.
Comment 3 Fernando Apesteguía freebsd_committer freebsd_triage 2022-02-23 14:12:57 UTC 
(In reply to Cameron Katri from comment #2)
Absolutely. Just it might not be as important having an outdated port than having an outdated port that poses a security risk.

Thanks for the report.
Comment 4 commit-hook freebsd_committer freebsd_triage 2024-02-06 21:27:24 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=2ea61fba9e948f627fd88f2318d82b20741f775d

commit 2ea61fba9e948f627fd88f2318d82b20741f775d
Author:     Tilman Keskinoz <arved@FreeBSD.org>
AuthorDate: 2024-02-06 21:22:24 +0000
Commit:     Tilman Keskinoz <arved@FreeBSD.org>
CommitDate: 2024-02-06 21:26:10 +0000

    devel/ghidra: Mark FORBIDDEN contains a RCE

    PR:             260854
    Submitted by:   Cameron Katri
    Security:       https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-j3xg-fc2p-4jc4

 devel/ghidra/Makefile | 1 +
 1 file changed, 1 insertion(+)
Comment 5 Tilman Keskinoz freebsd_committer freebsd_triage 2024-02-06 21:28:02 UTC 
Since there hasn't been any interest in updating the port to the latest version, I have marked it FORBBIDDEN