Matthew Seaman <[email protected]> writes: > On 09/10/2017 16:57, Roger Marquis wrote: > >> The reason I ask is CVE-2017-12617 was announced almost a week ago yet >> there's no mention of it in the vulnerability database The tomcat8 >> port's Makefile also still points to the older, vulnerable version. >> Tomcat is one of those popular, internet-facing applications that sites >> need to check and/or update quickly when CVEs are released and most >> admins probably don't expect "pkg audit" to throw false negatives. > > Ports-secteam (and secteam, for that matter) will update VuXML when they > know about vulnerabilities that affect FreeBSD ports, however the usual > mechanism is that the port maintainer either updates VuXML themselves > directly or tells the appropriate people that there are vulnerabilities > that need to be recorded.
What happened to querying CVE database using CPE strings? ENOTIME is a common disease in volunteer projects, ports-secteam@ is no exception. Finding missing entries is trivial if one looks at Debian tracker. Let's pick something popular e.g., tiff-4.0.8 has 6 CVEs none of which are fixed in the port. https://wiki.freebsd.org/Ports/CPE _______________________________________________ [email protected] mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-ports To unsubscribe, send any mail to "[email protected]"
