https://en.angie.software/angie/docs/oss_changes/ lists 1.12.1 addresses: CVE-2026-42533 (for the rewrite module) CVE-2026-60005 CVE-2026-56434 (for the SSI module)
Created attachment 273347 [details] www/angie: update 1.12.0 => 1.12.1 I finally got my build hosts and ports trees back to a somewhat buildable state (several llvm-related ports are still broken thanks to the regressions introduced by making llvm dynamically linked...). Anyhow, I can at least build the full set of angie* ports. The attached patch updates angie to 1.12.1 Build, install and run tested OK on 14.4-RELEASE.
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=ec945e58c5d3a62aeb623a6ccaf2d9c1921820c2 commit ec945e58c5d3a62aeb623a6ccaf2d9c1921820c2 Author: Sebastian Oswald <sko@rostwald.de> AuthorDate: 2026-07-31 12:06:05 +0000 Commit: Yusuf Yaman <nxjoseph@FreeBSD.org> CommitDate: 2026-08-03 15:39:04 +0000 www/angie: update 1.12.0 => 1.12.1 This patch release brings various security and bug fixes. Changelog: https://en.angie.software/angie/docs/oss_changes/#angie-1-12-1 PR: 297154 Reported by: tjlegg@gmail.com Approved by: osa, vvd (Mentors, implicit) Security: CVE-2026-42533 Security: CVE-2026-60005 Security: CVE-2026-56434 MFH: 2026Q3 www/angie-module-auth-jwt/Makefile | 2 +- www/angie-module-auth-spnego/Makefile | 2 +- www/angie-module-auth-totp/Makefile | 2 +- www/angie-module-brotli/Makefile | 2 +- www/angie-module-cache-purge/Makefile | 2 +- www/angie-module-dav-ext/Makefile | 2 +- www/angie-module-echo/Makefile | 2 +- www/angie-module-enhanced-memcached/Makefile | 2 +- www/angie-module-eval/Makefile | 2 +- www/angie-module-geoip2/Makefile | 2 +- www/angie-module-headers-more/Makefile | 2 +- www/angie-module-jwt/Makefile | 2 +- www/angie-module-keyval/Makefile | 2 +- www/angie-module-lua/Makefile | 2 +- www/angie-module-ndk/Makefile | 2 +- www/angie-module-njs/Makefile | 2 +- www/angie-module-postgres/Makefile | 2 +- www/angie-module-redis2/Makefile | 2 +- www/angie-module-set-misc/Makefile | 2 +- www/angie-module-upload/Makefile | 2 +- www/angie-module-vod/Makefile | 2 +- www/angie-module-zstd/Makefile | 2 +- www/angie/Makefile | 2 +- www/angie/distinfo | 6 +++--- 24 files changed, 26 insertions(+), 26 deletions(-)
A commit in branch 2026Q3 references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=b5b8914761f4eb2461958492a22481ccfe15c396 commit b5b8914761f4eb2461958492a22481ccfe15c396 Author: Sebastian Oswald <sko@rostwald.de> AuthorDate: 2026-07-31 12:06:05 +0000 Commit: Yusuf Yaman <nxjoseph@FreeBSD.org> CommitDate: 2026-08-03 15:44:25 +0000 www/angie: update 1.12.0 => 1.12.1 This patch release brings various security and bug fixes. Changelog: https://en.angie.software/angie/docs/oss_changes/#angie-1-12-1 PR: 297154 Reported by: tjlegg@gmail.com Approved by: osa, vvd (Mentors, implicit) Security: CVE-2026-42533 Security: CVE-2026-60005 Security: CVE-2026-56434 MFH: 2026Q3 (cherry picked from commit ec945e58c5d3a62aeb623a6ccaf2d9c1921820c2) www/angie-module-auth-jwt/Makefile | 4 ++-- www/angie-module-auth-spnego/Makefile | 2 +- www/angie-module-auth-totp/Makefile | 2 +- www/angie-module-brotli/Makefile | 2 +- www/angie-module-cache-purge/Makefile | 2 +- www/angie-module-dav-ext/Makefile | 2 +- www/angie-module-echo/Makefile | 4 ++-- www/angie-module-enhanced-memcached/Makefile | 2 +- www/angie-module-eval/Makefile | 2 +- www/angie-module-geoip2/Makefile | 2 +- www/angie-module-headers-more/Makefile | 4 ++-- www/angie-module-jwt/Makefile | 2 +- www/angie-module-keyval/Makefile | 2 +- www/angie-module-lua/Makefile | 6 +++--- www/angie-module-ndk/Makefile | 2 +- www/angie-module-njs/Makefile | 2 +- www/angie-module-postgres/Makefile | 2 +- www/angie-module-redis2/Makefile | 2 +- www/angie-module-set-misc/Makefile | 2 +- www/angie-module-upload/Makefile | 2 +- www/angie-module-vod/Makefile | 4 ++-- www/angie-module-zstd/Makefile | 2 +- www/angie/Makefile | 2 +- www/angie/distinfo | 6 +++--- 24 files changed, 32 insertions(+), 32 deletions(-)
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=a6046e2fc2c6e170462574a2f54f392dc5c8126f commit a6046e2fc2c6e170462574a2f54f392dc5c8126f Author: Yusuf Yaman <nxjoseph@FreeBSD.org> AuthorDate: 2026-08-03 16:01:55 +0000 Commit: Yusuf Yaman <nxjoseph@FreeBSD.org> CommitDate: 2026-08-03 16:02:33 +0000 security/vuxml: Document www/angie vulnerabilities PR: 297154 Approved by: osa, vvd (Mentors, implicit) security/vuxml/vuln/2026.xml | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+)
Hi, Thank you for the collaboration! I have tested build in Poudriere on 14.4-RELEASE-amd64-main-aad97c3275e2 and it seems OK. Committed, thanks.
I just received a bunch of fallout notifications for some of the angie modules in the quarterly branch. It seems the module updates (from bug #297198, bug #297199 and bug #297200) have also been merged to quarterly but not their updated checksums in www/angie/distinfo. Should I prepare a patch for quarterly or can this be 'retrofitted' by fully merging the module updates to quarterly? Basically, angie/distinfo now has to be identical in quartely and latest now. `git diff origin/main origin/2026Q3 -- www/angie/distinfo` produces the necessary diff.
(In reply to Sebastian Oswald from comment #6) Hi Sebastian, Thank you, I have cherry-picked missing commits from main to 2026Q3 branch. Hopefully it will fix it. the commits were: www/angie-module-njs: Update 0.9.9 => 1.0.0 www/angie-module-echo: Update 0.64 => 0.65 www/angie-module-auth-jwt: Update 0.14.1 => 0.14.2
(In reply to Yusuf Yaman from comment #7) Thanks. distinfo for latest and quarterly are now the same as expected and a test build of all www/angie* ports from quarterly went through without errors. (except module-vod which can't be build because multimedia/vmaf is currently broken which is a dependency of ffmpeg...)