Bug 264426 - www/mitmproxy: Update to 8.0.0 (<=7.0.4 vulnerable to CVE-2022-24766)
Summary: www/mitmproxy: Update to 8.0.0 (<=7.0.4 vulnerable to CVE-2022-24766)
Status: Closed Overcome By Events
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: Normal Affects Many People
Assignee: Muhammad Moinur Rahman
URL: https://github.com/mitmproxy/mitmprox...
Keywords: needs-patch, needs-qa, security
Depends on: 264553 264782
Blocks:
  Show dependency tree / graph
 
Reported: 2022-06-03 07:41 UTC by p5B2EA84B3
Modified: 2024-06-08 03:59 UTC (History)
6 users (show)

See Also:
bugzilla: maintainer-feedback? (gaod)
p5B2EA84B3: maintainer-feedback? (python)
koobs: merge-quarterly?

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description p5B2EA84B3 2022-06-03 07:41:35 UTC 
https://github.com/mitmproxy/mitmproxy/security/advisories/GHSA-gcx2-gvj7-pxv3

Patches

The vulnerability has been fixed in mitmproxy 8.0.0 and above.

15 May 2022: mitmproxy 8.1.0
    Mitmproxy now requires Python 3.9 or above. (#5233, @mhils)
Comment 1 Kubilay Kocak freebsd_committer freebsd_triage 2022-06-03 07:46:10 UTC 
Thank you for your report. Pending port and vuxml entry updates
Comment 2 p5B2EA84B3 2022-06-11 10:19:05 UTC 
from https://docs.freebsd.org/en/books/porters-handbook/security/#security-notify

12.3. Keeping the Community Informed
12.3.1. The VuXML Database

A very important and urgent step to take as early after a security vulnerability is discovered as possible is to notify the community of port users about the jeopardy. Such notification serves two purposes. ...

What is the reason that mitmproxy still has no entry in the FreeBSD VuXML database?

The trust in the FreeBSD VuXML database suffers if entries are delayed.
Comment 3 Hung-Yi Chen 2022-06-20 09:46:21 UTC 
Thank you for your the notice. I've send a PR for vuxml database update: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=264782.
Comment 4 p5B2EA84B3 2022-06-20 13:50:42 UTC 
Creating a vuxml entry is not a reason for for creating a block on this PR.

Calling for bugmaster supervision here please.
Comment 5 p5B2EA84B3 2022-10-29 21:42:23 UTC 
Mitmproxy 9.0.0 has landed. Time to get rid of this security issue by upgrading the port. 

https://github.com/mitmproxy/mitmproxy/blob/main/CHANGELOG.md#28-october-2022-mitmproxy-900
Comment 6 Muhammad Moinur Rahman freebsd_committer freebsd_triage 2023-12-15 13:12:24 UTC 
Taking over as per the request of lwhsu@
Comment 7 p5B2EA84B3 2024-06-07 09:25:18 UTC 
Can you please give a status-report/outlook on the work returning a working py311-mitmproxy to the FreeBSD ports?
Comment 8 Mark Linimon freebsd_committer freebsd_triage 2024-06-08 03:59:16 UTC 
^Triage: obsoleted by 264993 (AFAICT).