Bug 208482 - security/wpa_supplicant: several upstream security advisories (CVE-2015-{5310,5315,5316})
Summary: security/wpa_supplicant: several upstream security advisories (CVE-2015-{5310...
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Some People
Assignee: John Marino
URL: http://w1.fi/security/
Keywords: needs-patch, needs-qa, security
Depends on:
Blocks:
 
Reported: 2016-04-03 12:54 UTC by Jason Unovitch
Modified: 2016-04-19 00:39 UTC (History)
1 user (show)

See Also:
bugzilla: maintainer-feedback? (marino)
junovitch: merge-quarterly?

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jason Unovitch freebsd_committer freebsd_triage 2016-04-03 12:54:07 UTC 
Upstream patches and advisories:
CVE-2015-5310 -- http://w1.fi/security/2015-6/
CVE-2015-5315 -- http://w1.fi/security/2015-7/
CVE-2015-5316 -- http://w1.fi/security/2015-8/
Comment 1 John Marino freebsd_committer freebsd_triage 2016-04-03 12:56:28 UTC 
Are you letting me know, or is there a patch in the works that you would like to see approved?
Comment 2 Jason Unovitch freebsd_committer freebsd_triage 2016-04-03 12:58:56 UTC 
(In reply to John Marino from comment #1)
I am just filing the report and am working on other things at the moment.
Comment 3 commit-hook freebsd_committer freebsd_triage 2016-04-18 21:06:23 UTC 
A commit references this bug:

Author: marino
Date: Mon Apr 18 21:05:28 UTC 2016
New revision: 413609
URL: https://svnweb.freebsd.org/changeset/ports/413609

Log:
  security/wpa_supplicant: patch 4 CVE security advisories

  These patches address the following:
    CVE-2015-5310
    CVE-2015-5314
    CVE-2015-5315
    CVE-2015-5316

  These patches were developed upstream and published as a response
  to the security advisories.

  PR:		208482
  Requested by:	Jason Unovitch

Changes:
  head/security/wpa_supplicant/Makefile
  head/security/wpa_supplicant/files/patch-2015-6-backported-WNM-Ignore-Key-Data-in-WNM-Sleep-Mode-Response-frame
  head/security/wpa_supplicant/files/patch-2015-7-EAP-pwd-peer-Fix-last-fragment-length-validation
  head/security/wpa_supplicant/files/patch-2015-7-EAP-pwd-server-Fix-last-fragment-length-validation
  head/security/wpa_supplicant/files/patch-2015-8-EAP-pwd-peer-Fix-error-path-for-unexpected-Confirm-m
Comment 4 John Marino freebsd_committer freebsd_triage 2016-04-18 21:08:36 UTC 
Thanks.  If this requires any change to vuxml, you might want to go ahead and make those changes.
Comment 5 commit-hook freebsd_committer freebsd_triage 2016-04-19 00:36:41 UTC 
A commit references this bug:

Author: junovitch
Date: Tue Apr 19 00:36:18 UTC 2016
New revision: 413617
URL: https://svnweb.freebsd.org/changeset/ports/413617

Log:
  Document wpa_supplicant security advisories

  PR:		208482
  Security:	CVE-2015-5310
  Security:	CVE-2015-5315
  Security:	CVE-2015-5316
  Security:	https://vuxml.FreeBSD.org/freebsd/976567f6-05c5-11e6-94fa-002590263bf5.html

Changes:
  head/security/vuxml/vuln.xml
Comment 6 commit-hook freebsd_committer freebsd_triage 2016-04-19 00:38:43 UTC 
A commit references this bug:

Author: junovitch
Date: Tue Apr 19 00:38:25 UTC 2016
New revision: 413618
URL: https://svnweb.freebsd.org/changeset/ports/413618

Log:
  MFH: r413609

  security/wpa_supplicant: patch 3 CVE security advisories

  These patches were developed upstream and published as a response
  to the security advisories.

  PR:		208482
  Security:	CVE-2015-5310
  Security:	CVE-2015-5315
  Security:	CVE-2015-5316
  Security:	https://vuxml.FreeBSD.org/freebsd/976567f6-05c5-11e6-94fa-002590263bf5.html
  Approved by:	ports-secteam (with hat)

Changes:
_U  branches/2016Q2/
  branches/2016Q2/security/wpa_supplicant/Makefile
  branches/2016Q2/security/wpa_supplicant/files/patch-2015-6-backported-WNM-Ignore-Key-Data-in-WNM-Sleep-Mode-Response-frame
  branches/2016Q2/security/wpa_supplicant/files/patch-2015-7-EAP-pwd-peer-Fix-last-fragment-length-validation
  branches/2016Q2/security/wpa_supplicant/files/patch-2015-7-EAP-pwd-server-Fix-last-fragment-length-validation
  branches/2016Q2/security/wpa_supplicant/files/patch-2015-8-EAP-pwd-peer-Fix-error-path-for-unexpected-Confirm-m
Comment 7 Jason Unovitch freebsd_committer freebsd_triage 2016-04-19 00:39:38 UTC 
(In reply to John Marino from comment #4)
Thanks John,  CVE-2015-5314 was for hostapd so that didn't need any documentation or mention as we don't support the option needed for the port to be impacted.