Lucas <[email protected]> wrote: > Hello ports, > > A quite simple release for prosody to fix a vulnerability in websockets > handling, disabled by default but quite common, at least acording to > Prosody's devs. Nevertheless, it might be good to merge into 7.0, if > possible. Details of the vuln in [0]. > > [0]: https://prosody.im/securit/advisory_20220113/ > > -Lucas
Release 0.11.12 introduced a memory leak in the fix, so now there is a 0.11.13 plugging that leak. Summary: * 0.11.12: - util.xml: Do not allow doctypes, comments or processing instructions * 0.11.13: - util.xml: Break reference to help the GC (fixes #1711) - util.xml: Deduplicate handlers for restricted XML -Lucas diff fc43682d4d073143eca1f985644b06c896e848b7 /usr/ports blob - b1dd6e4ac34df90ab7dc9455a66b898126ac13e0 file + net/prosody/Makefile --- net/prosody/Makefile +++ net/prosody/Makefile @@ -1,7 +1,7 @@ # $OpenBSD: Makefile,v 1.65 2022/01/07 20:26:38 rsadowski Exp $ COMMENT = communications server for Jabber/XMPP written in Lua -DISTNAME = prosody-0.11.11 +DISTNAME = prosody-0.11.13 CATEGORIES = net HOMEPAGE = https://prosody.im/ blob - 9ea70c30e4fffffe50e3d5903b718acd0975779f file + net/prosody/distinfo --- net/prosody/distinfo +++ net/prosody/distinfo @@ -1,2 +1,2 @@ -SHA256 (prosody-0.11.11.tar.gz) = oa+Q4tSsL3z4GzhUdRQOzuYL7B64MAPvta64l2WxN3Q= -SIZE (prosody-0.11.11.tar.gz) = 439395 +SHA256 (prosody-0.11.13.tar.gz) = OcYbNGoJtRJbYEy5aeFCBsu8uGyBFW/8a6LWJSfPBDI= +SIZE (prosody-0.11.13.tar.gz) = 439816
