Bug 267049 - mail/horde-imp: address ZDI-20-1051 / ZDI-CAN-10436
Summary: mail/horde-imp: address ZDI-20-1051 / ZDI-CAN-10436
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Some People
Assignee: horde
URL: https://www.zerodayinitiative.com/adv...
Keywords: security
Depends on:
Blocks:
 
Reported: 2022-10-14 11:30 UTC by Thierry Thomas
Modified: 2022-10-28 17:17 UTC (History)
2 users (show)

See Also:
bugzilla: maintainer-feedback? (horde)
thierry: merge-quarterly?

Attachments
Address ZDI-20-1051 / ZDI-CAN-10436. (2.65 KB, patch)
2022-10-14 11:30 UTC, Thierry Thomas 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Thierry Thomas freebsd_committer freebsd_triage 2022-10-14 11:30:53 UTC 
Created attachment 237299 [details]
Address ZDI-20-1051 / ZDI-CAN-10436.

Address ZDI-20-1051 / ZDI-CAN-10436: Prevent deserializing a class.

This seems related to CVE-2022-30287.

See <https://www.zerodayinitiative.com/advisories/ZDI-20-1051/>.

Patche from <https://github.com/horde/imp/pull/10/files>.
Comment 1 commit-hook freebsd_committer freebsd_triage 2022-10-28 17:13:16 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=dfa4c773430c9297b3f54d3b1a1202e18e7f120d

commit dfa4c773430c9297b3f54d3b1a1202e18e7f120d
Author:     Thierry Thomas <thierry@FreeBSD.org>
AuthorDate: 2022-10-14 08:35:37 +0000
Commit:     Thierry Thomas <thierry@FreeBSD.org>
CommitDate: 2022-10-28 17:12:27 +0000

    mail/horde-imp: address ZDI-20-1051 / ZDI-CAN-10436

    PR:             267049
    Approved by:    maintainer’s time-out
    Obtained from:  https://github.com/horde/imp/pull/10/files
    Fixes:          Address ZDI-20-1051 / ZDI-CAN-10436
    MFH:            2022Q4
    Security:       https://www.zerodayinitiative.com/advisories/ZDI-20-1051/

 mail/horde-imp/Makefile                             |  1 +
 mail/horde-imp/files/patch-config_prefs.php         |  6 +++---
 mail/horde-imp/files/patch-lib_Prefs_Sort.php (new) | 19 +++++++++++++++++++
 3 files changed, 23 insertions(+), 3 deletions(-)
Comment 2 commit-hook freebsd_committer freebsd_triage 2022-10-28 17:16:17 UTC 
A commit in branch 2022Q4 references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=f25808f72426f5644fe9a1c0d0d037aa9c16fb29

commit f25808f72426f5644fe9a1c0d0d037aa9c16fb29
Author:     Thierry Thomas <thierry@FreeBSD.org>
AuthorDate: 2022-10-14 08:35:37 +0000
Commit:     Thierry Thomas <thierry@FreeBSD.org>
CommitDate: 2022-10-28 17:15:44 +0000

    mail/horde-imp: address ZDI-20-1051 / ZDI-CAN-10436

    PR:             267049
    Approved by:    maintainer’s time-out
    Obtained from:  https://github.com/horde/imp/pull/10/files
    Fixes:          Address ZDI-20-1051 / ZDI-CAN-10436
    MFH:            2022Q4
    Security:       https://www.zerodayinitiative.com/advisories/ZDI-20-1051/

    (cherry picked from commit dfa4c773430c9297b3f54d3b1a1202e18e7f120d)

 mail/horde-imp/Makefile                             |  1 +
 mail/horde-imp/files/patch-config_prefs.php         |  6 +++---
 mail/horde-imp/files/patch-lib_Prefs_Sort.php (new) | 19 +++++++++++++++++++
 3 files changed, 23 insertions(+), 3 deletions(-)
Comment 3 Thierry Thomas freebsd_committer freebsd_triage 2022-10-28 17:17:13 UTC 
Committed, after maintainer’s time-out.