Bug 277319 - mail/opendkim affected by CVE-2022-48521
Summary: mail/opendkim affected by CVE-2022-48521
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: Norikatsu Shigemura
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-02-25 21:00 UTC by Yasuhito FUTATSUKI
Modified: 2024-03-07 14:17 UTC (History)
2 users (show)

See Also:
bugzilla: maintainer-feedback? (freebsd-ports)

Attachments
a patch to add a patch file address CVE-2022-48521, and fix BUG 276704 (1.72 KB, patch)
2024-02-27 03:03 UTC, Yasuhito FUTATSUKI 		no flags Details | Diff
a patch to add a patch file address CVE-2022-48521 (1.47 KB, patch)
2024-02-27 06:31 UTC, Yasuhito FUTATSUKI 		no flags Details | Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Yasuhito FUTATSUKI 2024-02-25 21:00:51 UTC 
Please see:
https://github.com/trusteddomainproject/OpenDKIM/issues/148
https://github.com/advisories/GHSA-3q5m-9r3g-pqfj

A Fix is available from:
https://github.com/trusteddomainproject/OpenDKIM/pull/189
(Although this PR is against develop branch, the diff can be applied clearly against OpenDKIM 2.10.3)
Comment 1 Yasuhito FUTATSUKI 2024-02-27 03:03:55 UTC 
Created attachment 248773 [details]
a patch to add a patch file address CVE-2022-48521, and fix BUG 276704

Here is a proposed patch to add a patch file brought from https://github.com/trusteddomainproject/OpenDKIM/pull/189.

It also contains a fix for Bug #276704, by restricting lua version in Makefile.
Comment 2 Yasuhito FUTATSUKI 2024-02-27 06:31:48 UTC 
Created attachment 248780 [details]
a patch to add a patch file address CVE-2022-48521

As I've found the cause of BUG 276704, I update my patch without changing USES line.
Comment 3 Norikatsu Shigemura freebsd_committer freebsd_triage 2024-03-07 13:05:04 UTC 
ping
Comment 4 commit-hook freebsd_committer freebsd_triage 2024-03-07 14:16:31 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=d1ebdbe935e64935459953aa49e47538724736fb

commit d1ebdbe935e64935459953aa49e47538724736fb
Author:     Yasuhito FUTATSUKI <freebsd-bug-report-yf@yf.bsdclub.org>
AuthorDate: 2024-03-07 14:15:00 +0000
Commit:     Norikatsu Shigemura <nork@FreeBSD.org>
CommitDate: 2024-03-07 14:15:00 +0000

    mail/opendkim: Security fix for CVE-2022-48521

    PR:             277319
    Security:       CVE-2022-48521
    Approved by:    hrs (mentor), maintainer timeout

 mail/opendkim/Makefile                             |  2 +-
 .../opendkim/files/patch-opendkim_opendkim.c (new) | 36 ++++++++++++++++++++++
 2 files changed, 37 insertions(+), 1 deletion(-)
Comment 5 Norikatsu Shigemura freebsd_committer freebsd_triage 2024-03-07 14:17:32 UTC 
I'll handle this.
Comment 6 Norikatsu Shigemura freebsd_committer freebsd_triage 2024-03-07 14:17:45 UTC 
Committed, done. Thanks!