Created attachment 219839 [details] Update to 2.0.2 - Update to 2.0.2 [1] security fix CVE-2020-28896 [1] https://marc.info/?l=mutt-users&m=160589518808669&w=2 portlint: ok. 1 expected warning. testport: ok. 121amd64.
Build and package info is available at https://gitlab.com/swills/freebsd-ports/pipelines/219288715
A commit references this bug: Author: fernape Date: Sun Nov 22 18:23:26 UTC 2020 New revision: 556068 URL: https://svnweb.freebsd.org/changeset/ports/556068 Log: mail/mutt: Update to 2.0.2 ChangeLog: https://marc.info/?l=mutt-users&m=160589518808669&w=2 vuxml entry in PR: 251278 PR: 251277 Submitted by: dereks@lifeofadishwasher.com MFH: 2020Q4 (blanket, security fix) Changes: head/mail/mutt/Makefile head/mail/mutt/distinfo
Committed, Derek, according to the CVE report, only 2.0.1 is affected and we don't have that in 2020Q4 (it is 1.14.7) so there is no need to MFH, right? Thanks!
No, I'm pretty sure it's <2.0.1 the code that's using goto bail is 15+ years old. I don't know if that CVE is fully documented. Where are you finding it's just 2.0.1?
(In reply to Derek Schrock from comment #4) Here it says it affects 2.0.1: https://security.archlinux.org/CVE-2020-28896 Here it says the code is only reserved: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28896 https://bugs.launchpad.net/bugs/cve/2020-28896
I think the way it's presented there is misleading. If you read the description it's "before 2.0.2" however the line items does say 2.0.1 but I don't believe that's the intent of that line item. Also, I just confirmed with upstream it's <2.0.2. This should be MFH. If MFH I'm assuming it's svncopy'ed to the Q-branch? The same patch wouldn't work there.
(In reply to Derek Schrock from comment #6) Yes, it is copied. Why won't it work?
(In reply to Fernando Apesteguía from comment #7) The patch context would be different and would fail to apply. However, since it's copied it's fine.
(In reply to Derek Schrock from comment #8) Oh, okay. I thought you meant something on the terms of missing dependencies on 2020Q4 or so. Yes, the merge will generate a conflict but it can be solved.
A commit references this bug: Author: fernape Date: Mon Nov 23 08:19:57 UTC 2020 New revision: 556093 URL: https://svnweb.freebsd.org/changeset/ports/556093 Log: MFH: r556068 mail/mutt: Update to 2.0.2 ChangeLog: https://marc.info/?l=mutt-users&m=160589518808669&w=2 vuxml entry in PR: 251278 PR: 251277 Submitted by: dereks@lifeofadishwasher.com Approved by: ports-secteam (blanket, security fix) Changes: _U branches/2020Q4/ branches/2020Q4/mail/mutt/Makefile branches/2020Q4/mail/mutt/distinfo branches/2020Q4/mail/mutt/files/extra-patch-forcebase64 branches/2020Q4/mail/mutt/files/patch-muttlib.c branches/2020Q4/mail/mutt/files/patch-threadcomplete branches/2020Q4/mail/mutt/pkg-plist
Merged. Build tested in 2020Q4. Thanks Derek!