security/vuxml: Fix ranges for Tomcat vulnerabilities

[michaelo]

Summary

Approved by: jrm (mentor), otis (mentor), osa, jbeich

[otis]

LGTM, but let also vvd@ (tomcat ports maintainer) check.

[jbeich]

security/vuxml/vuln/2025.xml

270

gt (greather than) unlike ge (greater or equal) will skip lower bound of the range e.g.,

$ make validate
$ pkg audit -f vuln-flat.xml tomcat110-11.0.0
0 problem(s) in 0 installed package(s) found.

274

Ditto: gt vs. ge.

278

Ditto: gt vs. ge.

[michaelo]

Update with <ge>

[michaelo]

Done.

[vvd]

Add tomcat-devel to the list as well.

[michaelo]

Add tomcat-devel

[michaelo]

In D51323#1172091, @vvd wrote:

Add tomcat-devel to the list as well.

Done.

[michaelo]

@jbeich, any objections?

[jbeich]

security/vuxml/vuln/2025.xml

270

Why lower bound is necessary? It doesn't include pre-releases like m26 before 0215567cf55a, 10.1.* series before b5f9ca9d84f3, 10.0.* series before 839de580f358, 9.0.* series before 0e0430dc191c.

In non-devel ports lower bound is harmless but redundant. For example, tomcat* in VuXML from 2020 didn't use it.

[michaelo]

security/vuxml/vuln/2025.xml

270

Please note that I didn't add the lower bound, I am just fixing the range expression.

[jbeich]

security/vuxml/vuln/2025.xml

8883

Add modified like 3483eb36894a. Changing range is not cosmetic, so need to refresh vuxml.FreeBSD.org even if there were no new entries.

[jbeich]

security/vuxml/vuln/2025.xml

270

If you're not fixing drop tomcat-devel as out-of-scope. It has too few VuXML entries, so users are likely expected to stay up-to-date or switch to a stable version (suffixed packages).

[michaelo]

Remove tomcat-devel

[michaelo]

@jbeich , we are now back to the minimalistic patch.

[jbeich]

Looks fine. May still need <modified> but it's probably not critical.

[michaelo]

Add modified