Bug 241424 - sysutils/file: Update to 5.37, Fix CVE-2019-18218
Summary: sysutils/file: Update to 5.37, Fix CVE-2019-18218
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: Normal Affects Many People
Assignee: Raphael Kubo da Costa
URL: https://github.com/file/file/commit/4...
Keywords: buildisok, security
Depends on:
Blocks:
 
Reported: 2019-10-22 22:09 UTC by Nathan
Modified: 2019-11-03 11:54 UTC (History)
3 users (show)

See Also:
jharris: maintainer-feedback+
koobs: merge-quarterly?


Attachments
update ; add CVE patch (4.11 KB, patch)
2019-10-22 22:09 UTC, Nathan
jharris: maintainer-approval+
Details | Diff
VuXML entry (1.69 KB, patch)
2019-10-23 20:18 UTC, Nathan
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Nathan 2019-10-22 22:09:07 UTC
Created attachment 208516 [details]
update ; add CVE patch

Built fine in poudriere for:
12/13-amd64 12/13-i386 and 12arm64

Updated to 5.37; Cherry-picked from Github URL listed for CVE-2019-18218 listed here:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18218
Comment 1 Automation User 2019-10-22 22:18:09 UTC
Build info is available at https://gitlab.com/swills/freebsd-ports/pipelines/90736914
Comment 2 Nathan 2019-10-23 00:48:43 UTC
Hold off on this patch, noticed one thing I have to fix in the patch, will fix soon :)
Comment 3 Nathan 2019-10-23 01:23:36 UTC
Nervermind, relooking at it, and retesting patch, it does apply correctly after all, so feel free to continue
Comment 4 Kubilay Kocak freebsd_committer freebsd_triage 2019-10-23 02:14:38 UTC
^Triage: Pending VuXML entry
Comment 5 Nathan 2019-10-23 20:18:41 UTC
Created attachment 208539 [details]
VuXML entry
Comment 6 jharris 2019-10-27 22:08:05 UTC
Approved, albeit without personally testing.  Thanks!
Comment 7 commit-hook freebsd_committer 2019-11-02 12:19:52 UTC
A commit references this bug:

Author: rakuco
Date: Sat Nov  2 12:19:34 UTC 2019
New revision: 516308
URL: https://svnweb.freebsd.org/changeset/ports/516308

Log:
  Add entry for heap buffer overflow in sysutils/file.

  PR:		241424
  Submitted by:	Nathan Owens <ndowens04@gmail.com>
  Approved by:	jharris@widomaker.com (maintainer)

Changes:
  head/security/vuxml/vuln.xml
Comment 8 commit-hook freebsd_committer 2019-11-02 12:23:56 UTC
A commit references this bug:

Author: rakuco
Date: Sat Nov  2 12:23:41 UTC 2019
New revision: 516311
URL: https://svnweb.freebsd.org/changeset/ports/516311

Log:
  Update to 5.37 with patch for CVE-2019-18218.

  PR:		241424
  Submitted by:	Nathan Owens <ndowens04@gmail.com>
  Approved by:	jharris@widomaker.com (maintainer)
  MFH:		2019Q4
  Security:	381deebb-f5c9-11e9-9c4f-74d435e60b7c

Changes:
  head/sysutils/file/Makefile
  head/sysutils/file/distinfo
  head/sysutils/file/files/
  head/sysutils/file/files/patch-src_cdf.c
  head/sysutils/file/files/patch-src_cdf.h
Comment 9 commit-hook freebsd_committer 2019-11-02 12:26:58 UTC
A commit references this bug:

Author: rakuco
Date: Sat Nov  2 12:26:06 UTC 2019
New revision: 516312
URL: https://svnweb.freebsd.org/changeset/ports/516312

Log:
  Adjust entry 381deebb-f5c9-11e9-9c4f-74d435e60b7c for sysutils/file.

  Upstream version 5.37 is vulnerable, but the update to 5.37 in the ports tree
  was landed with a fix for the CVE entry.

  PR:		241424

Changes:
  head/security/vuxml/vuln.xml
Comment 10 Raphael Kubo da Costa freebsd_committer 2019-11-02 12:27:36 UTC
Thank you!
Comment 11 commit-hook freebsd_committer 2019-11-03 11:54:01 UTC
A commit references this bug:

Author: rakuco
Date: Sun Nov  3 11:53:37 UTC 2019
New revision: 516412
URL: https://svnweb.freebsd.org/changeset/ports/516412

Log:
  MFH: r516311

  Update to 5.37 with patch for CVE-2019-18218.

  PR:		241424
  Submitted by:	Nathan Owens <ndowens04@gmail.com>
  Approved by:	jharris@widomaker.com (maintainer)
  Security:	381deebb-f5c9-11e9-9c4f-74d435e60b7c

  Approved by:	ports-secteam (miwi)

Changes:
_U  branches/2019Q4/
  branches/2019Q4/sysutils/file/Makefile
  branches/2019Q4/sysutils/file/distinfo
  branches/2019Q4/sysutils/file/files/