Bug 274215 - mail/libspf2: add fix for CVE-2023-42118
Summary: mail/libspf2: add fix for CVE-2023-42118
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: Normal Affects Many People
Assignee: Po-Chuan Hsieh
URL: https://www.zerodayinitiative.com/adv...
Keywords: needs-patch, security
Depends on:
Blocks:
 
Reported: 2023-10-02 14:10 UTC by Kurt Jaeger
Modified: 2023-10-05 02:10 UTC (History)
4 users (show)

See Also:
bugzilla: maintainer-feedback? (sunpoet)
fluffy: merge-quarterly+

Attachments
patch-src_libspf2_spf__compile.c (682 bytes, text/plain)
2023-10-02 14:10 UTC, Kurt Jaeger 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Kurt Jaeger freebsd_committer freebsd_triage 2023-10-02 14:10:06 UTC 
Created attachment 245380 [details]
patch-src_libspf2_spf__compile.c

Add patch to files/ and rebuild.
Comment 1 Kurt Jaeger freebsd_committer freebsd_triage 2023-10-02 14:15:36 UTC 
See also:

https://www.zerodayinitiative.com/advisories/ZDI-23-1472/
Comment 2 Graham Perrin 2023-10-02 14:31:14 UTC 
^Triage: needs-patch (keyword) for VuXML, 

<https://vuxml.freebsd.org/>
Comment 3 Kurt Jaeger freebsd_committer freebsd_triage 2023-10-02 14:48:53 UTC 
Testbuilds are fine: 150 140 15i 132 124
Comment 4 Dima Panov freebsd_committer freebsd_triage 2023-10-03 20:34:32 UTC 
Plase MFH to 2023Q4
Comment 5 Kurt Jaeger freebsd_committer freebsd_triage 2023-10-04 06:28:42 UTC 
Source of the patch: https://github.com/shevek/libspf2/pull/44
Comment 6 Muhammad Moinur Rahman freebsd_committer freebsd_triage 2023-10-04 12:23:11 UTC 
pi@ please commit this with proper bump and proper entry in vuxml and:


Approved-by: portmgr
Comment 7 Kurt Jaeger freebsd_committer freebsd_triage 2023-10-04 18:39:58 UTC 
(In reply to Muhammad Moinur Rahman from comment #6)
I got in touch with upstream, the fix was already merged there -- and
some new release of libspf22 should come in the next few hours.
Comment 8 commit-hook freebsd_committer freebsd_triage 2023-10-04 18:44:02 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=3c178fb0a6bb19511eaa55e27e2c5018ab1fd216

commit 3c178fb0a6bb19511eaa55e27e2c5018ab1fd216
Author:     Kurt Jaeger <pi@FreeBSD.org>
AuthorDate: 2023-10-04 18:39:36 +0000
Commit:     Kurt Jaeger <pi@FreeBSD.org>
CommitDate: 2023-10-04 18:40:54 +0000

    security/vuxml: add entry for recent libspf2 CVE-2023-42118

    PR:     274215

 security/vuxml/vuln/2023.xml | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
Comment 9 commit-hook freebsd_committer freebsd_triage 2023-10-05 02:03:34 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=e0ce4912961cb8fcb88ea096eef3c3f82752be0b

commit e0ce4912961cb8fcb88ea096eef3c3f82752be0b
Author:     Po-Chuan Hsieh <sunpoet@FreeBSD.org>
AuthorDate: 2023-10-05 01:55:38 +0000
Commit:     Po-Chuan Hsieh <sunpoet@FreeBSD.org>
CommitDate: 2023-10-05 01:58:46 +0000

    mail/libspf2: Update to newer snapshot (d14abff)

    - Bump PORTREVISION for package change

    Changes:        https://github.com/shevek/libspf2/commits/master
    PR:             274215
    Reported by:    pi
    Security:       CVE-2023-42118

 mail/libspf2/Makefile | 3 ++-
 mail/libspf2/distinfo | 6 +++---
 2 files changed, 5 insertions(+), 4 deletions(-)
Comment 10 commit-hook freebsd_committer freebsd_triage 2023-10-05 02:08:36 UTC 
A commit in branch 2023Q4 references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=bbdef08a89c2124b0c149597f23d67c39cf3a522

commit bbdef08a89c2124b0c149597f23d67c39cf3a522
Author:     Po-Chuan Hsieh <sunpoet@FreeBSD.org>
AuthorDate: 2023-10-05 01:55:38 +0000
Commit:     Po-Chuan Hsieh <sunpoet@FreeBSD.org>
CommitDate: 2023-10-05 02:08:08 +0000

    mail/libspf2: Update to newer snapshot (d14abff)

    - Bump PORTREVISION for package change

    Changes:        https://github.com/shevek/libspf2/commits/master
    PR:             274215
    Reported by:    pi
    Security:       CVE-2023-42118

    (cherry picked from commit e0ce4912961cb8fcb88ea096eef3c3f82752be0b)

 mail/libspf2/Makefile | 3 ++-
 mail/libspf2/distinfo | 6 +++---
 2 files changed, 5 insertions(+), 4 deletions(-)
Comment 11 Po-Chuan Hsieh freebsd_committer freebsd_triage 2023-10-05 02:10:35 UTC 
Since upstream has merged the fix, I simply move this port to a newer snapshot. The security issue should be fixed in both main and quarterly branch now. Thanks.