Created attachment 272596 [details] 0001-security-mbedtls4-update-4.1.0-4.2.0.patch
Created attachment 272597 [details] 0002-security-vuxml-document-mbedtls4-vulnerabilities.patch
Created attachment 272598 [details] 0001-security-mbedtls4-update-4.1.0-4.2.0.patch
Created attachment 272599 [details] 0001-www-hiawatha-bump-after-mbedtls4-update.patch
Created attachment 272606 [details] 0001-security-vuxml-document-mbedtls4-vulnerabilities.patch
Why www/hiawatha need PORTREVISION bump? soname didn't changed, isn't it?
(In reply to Vladimir Druzenko from comment #5) I'm not 100% sure, but lib/libtfpsacrypto.so 1.1.0 => 1.2.0
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=2162d1df3425fc85695529db4ba754c57766aab1 commit 2162d1df3425fc85695529db4ba754c57766aab1 Author: Paavo-Einari Kaipila <pkaipila@gmail.com> AuthorDate: 2026-07-08 13:55:15 +0000 Commit: Vladimir Druzenko <vvd@FreeBSD.org> CommitDate: 2026-07-08 13:57:33 +0000 security/mbedtls4: Update 4.1.0 => 4.2.0 (fix 10 CVEs) Changelog: https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-4.2.0 - Parametrize PKGNAMESUFFIX. - Improve PORTSCOUT. PR: 296595 Security: CVE-2026-50581 Security: CVE-2026-50640 Security: CVE-2026-50580 Security: CVE-2026-50586 Security: CVE-2026-50588 Security: CVE-2026-50579 Security: CVE-2026-54441 Security: CVE-2026-50585 Security: CVE-2026-25832 Security: CVE-2026-49300 Sponsored by: UNIS Labs MFH: 2026Q2 security/mbedtls4/Makefile | 13 +++---------- security/mbedtls4/distinfo | 8 +++----- security/mbedtls4/files/patch-library_CMakeLists.txt (gone) | 11 ----------- security/mbedtls4/pkg-plist | 2 +- 4 files changed, 7 insertions(+), 27 deletions(-)
A commit in branch 2026Q2 references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=9a070ee6d3e149080ca6c37eb9d1dcb6f0273310 commit 9a070ee6d3e149080ca6c37eb9d1dcb6f0273310 Author: Paavo-Einari Kaipila <pkaipila@gmail.com> AuthorDate: 2026-07-08 13:55:15 +0000 Commit: Vladimir Druzenko <vvd@FreeBSD.org> CommitDate: 2026-07-08 13:58:19 +0000 security/mbedtls4: Update 4.1.0 => 4.2.0 (fix 10 CVEs) Changelog: https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-4.2.0 - Parametrize PKGNAMESUFFIX. - Improve PORTSCOUT. PR: 296595 Security: CVE-2026-50581 Security: CVE-2026-50640 Security: CVE-2026-50580 Security: CVE-2026-50586 Security: CVE-2026-50588 Security: CVE-2026-50579 Security: CVE-2026-54441 Security: CVE-2026-50585 Security: CVE-2026-25832 Security: CVE-2026-49300 Sponsored by: UNIS Labs MFH: 2026Q2 (cherry picked from commit 2162d1df3425fc85695529db4ba754c57766aab1) security/mbedtls4/Makefile | 13 +++---------- security/mbedtls4/distinfo | 8 +++----- security/mbedtls4/files/patch-library_CMakeLists.txt (gone) | 11 ----------- security/mbedtls4/pkg-plist | 2 +- 4 files changed, 7 insertions(+), 27 deletions(-)
(In reply to Paavo-Einari Kaipila from comment #6) 4.1.0: readelf -d /usr/local/lib/libtfpsacrypto.so.1.1.0 | grep SONAME 0x000000000000000e SONAME Library soname: [libtfpsacrypto.so.2] 4.2.0: readelf -d /usr/local/lib/libtfpsacrypto.so.1.2.0 | grep SONAME 0x000000000000000e SONAME Library soname: [libtfpsacrypto.so.2] SONAME didn't changed.
(In reply to Vladimir Druzenko from comment #9) Oh, yeah so.2 is a symlink to so.1.2.0 Why hasn't Q3 been branched btw?
(In reply to Paavo-Einari Kaipila from comment #10) I don’t know the details, but apparently they didn’t have time to finish something. Maybe this bug #270358.