50.0.0
Needs RevisionPublic
Actions

Authored by longros on Wed, Oct 21, 5:36 PM.

Project Tags

None

Referenced Files

None

Subscribers

None

Details

Reviewers

jrm
yuri

Summary

This update fixes twenty security advisories, which upstream fixed in
49.0.3 and 49.0.4.

Changelogs:
https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.3
https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4
https://github.com/bytecodealliance/wasmtime/releases/tag/v50.0.0

Security: GHSA-93g3-36p8-x2gc
Security: GHSA-3r89-v5mq-j5xf
Security: GHSA-7v24-42x9-pxf7
Security: GHSA-5hhx-4wrr-3j9g
Security: GHSA-m6w2-jwq2-cv2c
Security: GHSA-hmwq-g22x-qjw5
Security: GHSA-wjc8-633q-pwxr
Security: GHSA-vcg5-q8m5-8379
Security: GHSA-63h4-6cx9-pjfj
Security: GHSA-q554-3cjc-rx7p
Security: GHSA-p79w-pv2r-29qp
Security: GHSA-m9f7-9w4p-gv38
Security: GHSA-54p9-vhhq-8f7q
Security: GHSA-5qpp-g3j2-8frx
Security: GHSA-w36r-2hch-9xp9
Security: GHSA-r8xh-cgf7-392j
Security: GHSA-jxcf-8qw5-5c33
Security: GHSA-9prg-84vf-g5fc
Security: GHSA-mghf-wjfp-p5xm
Security: GHSA-9pvw-hwfg-92h5

Test Plan

poudriere testport passes on 14.4-RELEASE, 14.5-RELEASE and 15.1-RELEASE amd64.

VuXML: make validate passes too

Diff Detail

Repository

R11 FreeBSD ports repository

Lint

Lint Skipped

Unit

Tests Skipped

Build Status

Buildable 78461
Build 75344: arc lint + arc unit

Event Timeline

longros requested review of this revision.Wed, Oct 21, 5:36 PM

longros created this revision.

Harbormaster completed remote builds in B78459: Diff 190498.Wed, Oct 21, 5:36 PM

Add VuXML entry

Harbormaster completed remote builds in B78461: Diff 190500.Wed, Oct 21, 5:37 PM

longros edited the test plan for this revision. (Show Details)Wed, Oct 21, 5:39 PM

Could you make the VuXML entry a separate commit? It looks like lots of other ports that bundle wasmtime are vulnerable (please confirm).

git -C /usr/ports grep -E 'wasmtime-[0-9]+\.[0-9]+\.[0-9]+' '*/*/Makefile*'
cad/surfer/Makefile.crates:     wasmtime-41.0.4 \
cad/veryl/Makefile.crates:      wasmtime-49.0.1 \
databases/mongodb90/Makefile.crates:        wasmtime-44.0.1 \
databases/surrealdb/Makefile:       wasmtime-48.0.5 \
devel/codemark/Makefile.crates:     wasmtime-29.0.1 \
devel/moon/Makefile.crates:     wasmtime-43.0.2 \
devel/tree-sitter-cli/Makefile.crates:      wasmtime-36.0.14 \
devel/wizer/Makefile:       wasmtime-42.0.1 \
editors/gram/Makefile.crates:       wasmtime-36.0.14 \
editors/lapce/Makefile.crates:      wasmtime-14.0.2 \
editors/vscode/Makefile.crates:     wasmtime-36.0.10 \
editors/zed/Makefile.crates:        wasmtime-48.0.1 \
games/veloren-weekly/Makefile.crates:       wasmtime-49.0.2 \
misc/zeroclaw/Makefile:     wasmtime-41.0.4 \
x11/waveterm/Makefile.crates:       wasmtime-38.0.4 \

Since there are 20 GHSA, rather than referencing them all in the devel/libwasmtime commit log, perhaps just point to the VuXML entry with Security: 57e6e702-cd69-11f1-b0e3-74563cf85f9d.

This revision is now accepted and ready to land.Wed, Oct 21, 6:32 PM

jrm requested changes to this revision.Wed, Oct 21, 6:32 PM

This revision now requires changes to proceed.Wed, Oct 21, 6:32 PM

In D60940#1397408, @jrm wrote:

Could you make the VuXML entry a separate commit? It looks like lots of other ports that bundle wasmtime are vulnerable (please confirm).

git -C /usr/ports grep -E 'wasmtime-[0-9]+\.[0-9]+\.[0-9]+' '*/*/Makefile*'
cad/surfer/Makefile.crates:     wasmtime-41.0.4 \
cad/veryl/Makefile.crates:      wasmtime-49.0.1 \
databases/mongodb90/Makefile.crates:        wasmtime-44.0.1 \
databases/surrealdb/Makefile:       wasmtime-48.0.5 \
devel/codemark/Makefile.crates:     wasmtime-29.0.1 \
devel/moon/Makefile.crates:     wasmtime-43.0.2 \
devel/tree-sitter-cli/Makefile.crates:      wasmtime-36.0.14 \
devel/wizer/Makefile:       wasmtime-42.0.1 \
editors/gram/Makefile.crates:       wasmtime-36.0.14 \
editors/lapce/Makefile.crates:      wasmtime-14.0.2 \
editors/vscode/Makefile.crates:     wasmtime-36.0.10 \
editors/zed/Makefile.crates:        wasmtime-48.0.1 \
games/veloren-weekly/Makefile.crates:       wasmtime-49.0.2 \
misc/zeroclaw/Makefile:     wasmtime-41.0.4 \
x11/waveterm/Makefile.crates:       wasmtime-38.0.4 \

Since there are 20 GHSA, rather than referencing them all in the devel/libwasmtime commit log, perhaps just point to the VuXML entry with Security: 57e6e702-cd69-11f1-b0e3-74563cf85f9d.

Yes, I confirm that many bundled wasmtime ports are vulnerable (the same as you listed). I will update the diff. The VuXML entry is already a separate commit