Bug 291307 - www/fcgi: Update to 2.4.7 (fixes CVE-2025-23016)
Summary: www/fcgi: Update to 2.4.7 (fixes CVE-2025-23016)
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Some People
Assignee: Vladimir Druzenko
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-11-30 19:06 UTC by Christos Chatzaras
Modified: 2025-12-01 02:19 UTC (History)
2 users (show)

See Also:
vvd: maintainer-feedback+

Attachments
Update fcgi to 2.4.7 (1.31 KB, patch)
2025-11-30 19:11 UTC, Christos Chatzaras 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Christos Chatzaras 2025-11-30 19:06:01 UTC 
It seems that version 2.4.7 includes an extra patch addressing CVE-2025-23016:

https://github.com/FastCGI-Archives/fcgi2/releases/tag/2.4.7
Comment 1 Christos Chatzaras 2025-11-30 19:11:34 UTC 
Created attachment 265736 [details]
Update fcgi to 2.4.7
Comment 2 Vladimir Druzenko freebsd_committer freebsd_triage 2025-12-01 01:57:59 UTC 
1. Maintainer is John von Essen <john@essenz.com> - last activity 2019.
2. Fix CVE.
Comment 3 commit-hook freebsd_committer freebsd_triage 2025-12-01 02:14:57 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=1a30da80670973368b399f2b01fe9c04b91a1273

commit 1a30da80670973368b399f2b01fe9c04b91a1273
Author:     Christos Chatzaras <chris@cretaforce.gr>
AuthorDate: 2025-12-01 02:11:24 +0000
Commit:     Vladimir Druzenko <vvd@FreeBSD.org>
CommitDate: 2025-12-01 02:11:24 +0000

    www/fcgi: Update 2.4.6 => 2.4.7 (fixes CVE-2025-23016)

    Commit log:
    https://github.com/FastCGI-Archives/fcgi2/compare/2.4.6...2.4.7

    Changelog:
    https://github.com/FastCGI-Archives/fcgi2/releases/tag/2.4.7

    PR:             291307
    Approved by:    John von Essen <john@essenz.com> (maintainer, implicit - last activity 2019)
    Security:       CVE-2025-23016
    MFH:            2025Q4

 www/fcgi/Makefile | 7 +++----
 www/fcgi/distinfo | 6 +++---
 2 files changed, 6 insertions(+), 7 deletions(-)
Comment 4 Vladimir Druzenko freebsd_committer freebsd_triage 2025-12-01 02:16:08 UTC 
While here optimize strip and remove unnecessary MKDIR - COPYTREE_SHARE create dir self.
Comment 5 commit-hook freebsd_committer freebsd_triage 2025-12-01 02:16:59 UTC 
A commit in branch 2025Q4 references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=02853b7f8adb7a27f4adf6e9187ce180b88e4ff5

commit 02853b7f8adb7a27f4adf6e9187ce180b88e4ff5
Author:     Christos Chatzaras <chris@cretaforce.gr>
AuthorDate: 2025-12-01 02:11:24 +0000
Commit:     Vladimir Druzenko <vvd@FreeBSD.org>
CommitDate: 2025-12-01 02:16:19 +0000

    www/fcgi: Update 2.4.6 => 2.4.7 (fixes CVE-2025-23016)

    Commit log:
    https://github.com/FastCGI-Archives/fcgi2/compare/2.4.6...2.4.7

    Changelog:
    https://github.com/FastCGI-Archives/fcgi2/releases/tag/2.4.7

    PR:             291307
    Approved by:    John von Essen <john@essenz.com> (maintainer, implicit - last activity 2019)
    Security:       CVE-2025-23016
    MFH:            2025Q4

    (cherry picked from commit 1a30da80670973368b399f2b01fe9c04b91a1273)

 www/fcgi/Makefile | 7 +++----
 www/fcgi/distinfo | 6 +++---
 2 files changed, 6 insertions(+), 7 deletions(-)
Comment 6 Vladimir Druzenko freebsd_committer freebsd_triage 2025-12-01 02:19:43 UTC 
Thanks.