wordpress -- multiple issues

[joneum]

Summary

Document wordpress issues

Approved by: xxx (mentor)
#Differential Revision: https://reviews.freebsd.org/Dxxxxx

[tcberner]

security/vuxml/vuln.xml

61

indentation?

[joneum]

security/vuxml/vuln.xml

61

???

[tcberner]

security/vuxml/vuln.xml

61

[joneum]

update

[tcberner]

security/vuxml/vuln.xml

72

^ it puts the url in the basket

[joneum]

.......

[tcberner]

security/vuxml/vuln.xml

66

^ you have to respect PORTEPOCH

5 PORTVERSION=    4.8.2
6 PORTEPOCH=      1

https://www.freebsd.org/doc/en/books/porters-handbook/security-notify.html:
The version ranges have to allow for PORTEPOCH and PORTREVISION if applicable. Please remember that according to the collation rules, a version with a non-zero PORTEPOCH is greater than any version without PORTEPOCH, for example, 3.0,1 is greater than 3.1 or even than 8.9.

[tcberner]

You need the ",1" in the <lt>

#  pkg audit -f security/vuxml/vuln.xml wordpress-4.8.2,1
wordpress-4.8.2,1 is vulnerable:
wordpress -- multiple issues
WWW: https://vuxml.FreeBSD.org/freebsd/cee3d12f-bf41-11e7-bced-00e04c1ea73d.html

1 problem(s) in the installed packages found.

 #  pkg audit -f security/vuxml/vuln.xml wordpress-4.8.3,1
0 problem(s) in the installed packages found.

otherwise you'll still have

#  pkg audit -f security/vuxml/vuln.xml wordpress-4.8.2,1
0 problem(s) in the installed packages found.

[joneum]

security/vuxml/vuln.xml

66

https://svnweb.freebsd.org/changeset/ports/450900

[joneum]

......

[tcberner]

[tcberner]

Looking at your commit for the wordpresses, I noticed, that this needs some more wokr, as not all the wordpress ports have PORTEPOCH. This will be fun :)

[tcberner]

Can you look into ports r435685 how it was done there?
To handle the different worpdress ports properly -- sorry, I did not catch that earlier.

[tcberner]

Looking at the pkgnames

zh-wordpress-zh_CN-4.8.1
zh-wordpress-zh_TW-4.8.2
fr-wordpress-4.8.3,1
de-wordpress-4.8.3
ja-wordpress-4.8.3
ru-wordpress-4.8.3
wordpress-4.8.3,1

you could probably do something like

63     <affects>
64       <package>
65         <name>wordpress</name>
66         <name>fr-wordpress</name>
67         <range><lt>4.8.3,1</lt></range>
68       </package>
69       <package>
70         <name>de-wordpress</name>
71         <name>ja-wordpress</name>
72         <name>ru-wordpress</name>
73         <range><lt>4.8.3</lt></range>
74       </package>
75     </affects>

[tz]

security/vuxml/vuln.xml

61

:D
If no Picard is there to help, just use "make validate". It will also complain about indentation and also create one file with correct space.

[tcberner]

Has been made obsolete by the recent newest vulnerability :D