277692 – net/quiche: update to 0.20.1 (fixes 2 CVE's)

Bug 277692 - net/quiche: update to 0.20.1 (fixes 2 CVE's)

Summary: net/quiche: update to 0.20.1 (fixes 2 CVE's)

Status:	Closed FIXED

Alias:	None

Product:	Ports & Packages
Classification:	Unclassified
Component:	Individual Port(s) (show other bugs)
Version:	Latest
Hardware:	Any Any

Importance:	--- Affects Many People
Assignee:	Fernando Apesteguía

URL:	https://github.com/cloudflare/quiche/...
Keywords:

Depends on:
Blocks:	277468
	Show dependency tree / graph

Reported:	2024-03-14 13:42 UTC by Ralf van der Enden
Modified:	2024-03-29 17:50 UTC (History)
CC List:	3 users (show)

See Also:

Flags:	junho.choi: maintainer-feedback+ tremere: maintainer-feedback? tremere: merge-quarterly?

Attachments
Update quiche to 0.20.1 (2.44 KB, patch) 2024-03-14 13:44 UTC, Ralf van der Enden	fernape: maintainer-approval+	Details \| Diff
Add entry to VuXML for quiche (1.42 KB, patch) 2024-03-26 10:22 UTC, Ralf van der Enden	no flags	Details \| Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Ralf van der Enden 2024-03-14 13:42:14 UTC

Comment 1 Ralf van der Enden 2024-03-14 13:44:13 UTC

Created attachment 249158 [details]
Update quiche to 0.20.1

Comment 2 Junho Choi 2024-03-15 04:48:42 UTC

LGTM. Thanks

Comment 3 Ralf van der Enden 2024-03-26 10:22:57 UTC

Created attachment 249492 [details]
Add entry to VuXML for quiche

Comment 4 commit-hook freebsd_committer

2024-03-29 17:47:33 UTC

A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=cb4b734b55c9805e5c9263913d6697b3e5c30135

commit cb4b734b55c9805e5c9263913d6697b3e5c30135
Author:     Ralf van der Enden <tremere@cainites.net>
AuthorDate: 2024-03-29 17:45:22 +0000
Commit:     Fernando Apesteguía <fernape@FreeBSD.org>
CommitDate: 2024-03-29 17:45:22 +0000

    security/vuxml: Register net/quiche vulnerabilities

    PR:             277692
    Reported by:    Ralf van der Enden <tremere@cainites.net>
    Approved by:    junho.choi@gmail.com (maintainer)

 security/vuxml/vuln/2024.xml | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

Comment 5 Fernando Apesteguía freebsd_committer

2024-03-29 17:50:17 UTC

Committed,

Thanks!

Comment 6 commit-hook freebsd_committer

2024-03-29 17:50:35 UTC

A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=0e1153d3a54a948a42504816c4b43eacc7805bd7

commit 0e1153d3a54a948a42504816c4b43eacc7805bd7
Author:     Junho Choi <junho.choi@gmail.com>
AuthorDate: 2024-03-26 18:58:00 +0000
Commit:     Fernando Apesteguía <fernape@FreeBSD.org>
CommitDate: 2024-03-29 17:47:44 +0000

    net/quiche: update to 0.20.1

    Fixes security issues.

     * CVE-2024-1410
             * Base Score:  N/A
             * Vector:  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

     * CVE-2024-1765
            * Base Score:  N/A
            * Vector:  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

    PR:             277692
    Reported by:    Ralf van der Enden <tremere@cainites.net>
    Approved by:    junho.choi@gmail.com (maintainer)
    Security:       CVE-2024-1410 CVE-2024-1765

 net/quiche/Makefile | 3 +--
 net/quiche/distinfo | 6 +++---
 2 files changed, 4 insertions(+), 5 deletions(-)