Bug 208404 - [patch] net/openvswitch CVE-2016-2074
Summary: [patch] net/openvswitch CVE-2016-2074
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Some People
Assignee: Kevin Lo
URL:
Keywords: patch, security
Depends on:
Blocks:
 
Reported: 2016-03-30 18:24 UTC by Olli Hauer
Modified: 2016-07-03 23:20 UTC (History)
1 user (show)

See Also:
bugzilla: maintainer-feedback? (kevlo)
junovitch: merge-quarterly-

Attachments
patch lib/flow.c (2.28 KB, patch)
2016-03-30 18:24 UTC, Olli Hauer 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Olli Hauer freebsd_committer freebsd_triage 2016-03-30 18:24:10 UTC 
Created attachment 168794 [details]
patch lib/flow.c

I just read about an issue on openvswitch (CVE-2016-2074) but there is a simple patch and also already a new 2.3.3 release available [1]

I shaped only the patch from the CVE announcement [1] and tested a quick build, not functionality testing was made 

[1] http://openvswitch.org/pipermail/announce/2016-March/000082.html
Comment 1 commit-hook freebsd_committer freebsd_triage 2016-05-29 09:47:19 UTC 
A commit references this bug:

Author: ohauer
Date: Sun May 29 09:46:33 UTC 2016
New revision: 416090
URL: https://svnweb.freebsd.org/changeset/ports/416090

Log:
  - document openvswitch CVE-2016-2074

  PR:		208404
  Submitted by:	ohauer

Changes:
  head/security/vuxml/vuln.xml
Comment 2 commit-hook freebsd_committer freebsd_triage 2016-07-03 23:13:38 UTC 
A commit references this bug:

Author: junovitch
Date: Sun Jul  3 23:13:14 UTC 2016
New revision: 418004
URL: https://svnweb.freebsd.org/changeset/ports/418004

Log:
  Update earlier openvswitch entry with version fixed in ports

  PR:		208404
  Reported by:	ohauer
  Security:	CVE-2016-2074
  Security:	https://vuxml.FreeBSD.org/freebsd/b53bbf58-257f-11e6-9f4d-20cf30e32f6d.html

Changes:
  head/security/vuxml/vuln.xml
Comment 3 Jason Unovitch freebsd_committer freebsd_triage 2016-07-03 23:20:46 UTC 
The fix landed in https://svnweb.FreeBSD.org/changeset/ports/417410 on 2016-06-24.  This is already in the current 2016Q3 so the merge-quarterly portion is overcome by events (setting merge-quarterly-).

Setting this as fixed as well as there is no further work to do and fixing the CC after the fact.