On Fri, 11 Aug 2017, Remko Lodder wrote:
If an entry is removed from the ports/pkg tree?s and it is also removed
from VuXML, then yes, it will no longer get marked in your local
installation. That?s a bit of a chicken and egg basically. Although I do
not recall that it ever happened that ports that are no longer there, are
removed from VuXML as well. (And I follow that since 2004).
Do you have a more concrete example that we can dive into to see what is
going on/going wrong?
Should be able to find missing vulxml entries for most anything that has
been deprecated from the ports tree but most of the ones I've seen are
for web programming languages, particularly php.
For example when php5X was dropped it also disappeared from vulxml, with
no small number of servers still using it. If those sites depended on
pkg-audit to tell them they had a vulnerability, well, they were out of
luck. There was no warning, no error, no disclaimer, pkg-audit did and
still does nothing different than it would for a non-vulnerable port or
package.
There may be more vulnerabilities in the wild from non-packaged base as
it is larger but at least people are working on that. Pkg-audit
tracking of installed but deprecated ports OTOH, seems to have fallen
through the cracks. Even the FreeBSD Foundation and the ports-security
teams appear to be ignoring this issue.
Roger Marquis
_______________________________________________
freebsd-security@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscr...@freebsd.org"
