Change Details

There are three security vulnerabilities described for systutils/py-salt in version 3002[1]: CVE-2020-16846, CVE-2020-17490, and VE-2020-25592. [1] https://docs.saltstack.com/en/latest/topics/releases/3002.1.html After this VuXML entry is committed, the port will be updated, see PR 251013. - This patch adds a new entry for sysutils/py-salt with all three CVEs described in vuln.xml - There are three flavors of the port, which have to be checked (py36, py37, py38) - 'make validate' is fine with the entry - vxquery shows information as expected #vxquery /usr/ports/security/vuxml/vuln.xml py37-salt-3002_2 Topic: salt -- multiple vulnerabilities Affects: 3002 <= py36-salt < 3002.1 3002 <= py37-salt < 3002.1 3002 <= py38-salt < 3002.1 References: url:https://docs.saltstack.com/en/latest/topics/releases/3002.1.html cvename:CVE-2020-16486 url:https://nvd.nist.gov/vuln/detail/CVE-2020-16746 cvename:CVE-2020-17490 url:https://nvd.nist.gov/vuln/detail/CVE-2020-17490 cvename:CVE-2020-25592 url:https://nvd.nist.gov/vuln/detail/CVE-2020-25592 <URL:http://vuxml.freebsd.org/50259d8b-243e-11eb-8bae-b42e99975750.html> Also 'make VID=50259d8b-243e-11eb-8bae-b42e99975750 html' renders fine, the links in the html are all functional. What I am not sure about is the range for the vulnerable version. Only version 3002 is vulnerable, not 3001.3 nor 3002.1. I am using '<range><ge>3002</ge><lt>3002.1</lt></range>' for this, because I found no working example with <eq>3002</eq>.

There are three security vulnerabilities described for systutils/py-salt in version 3002[1]: CVE-2020-16846, CVE-2020-17490, and VE-2020-25592. [1] https://docs.saltstack.com/en/latest/topics/releases/3002.1.html After this VuXML entry is committed, the port will be updated, see PR 251013. - This patch adds a new entry for sysutils/py-salt with all three CVEs described in vuln.xml - There are three flavors of the port, which have to be checked (py36, py37, py38) - 'make validate' is fine with the entry - vxquery shows information as expected ``` #vxquery /usr/ports/security/vuxml/vuln.xml py37-salt-3002_2 Topic: salt -- multiple vulnerabilities Affects: 3002 <= py36-salt < 3002.1 3002 <= py37-salt < 3002.1 3002 <= py38-salt < 3002.1 References: url:https://docs.saltstack.com/en/latest/topics/releases/3002.1.html cvename:CVE-2020-16486 url:https://nvd.nist.gov/vuln/detail/CVE-2020-16746 cvename:CVE-2020-17490 url:https://nvd.nist.gov/vuln/detail/CVE-2020-17490 cvename:CVE-2020-25592 url:https://nvd.nist.gov/vuln/detail/CVE-2020-25592 <URL:http://vuxml.freebsd.org/50259d8b-243e-11eb-8bae-b42e99975750.html> ``` Also '`make VID=50259d8b-243e-11eb-8bae-b42e99975750 html`' renders fine, the links in the html are all functional. What I am not sure about is the range for the vulnerable version. Only version 3002 is vulnerable, not 3001.3 nor 3002.1. I am using '`<range><ge>3002</ge><lt>3002.1</lt></range>`' for this, because I found no working example with `<eq>3002</eq>`.

There are three security vulnerabilities described for systutils/py-salt in version 3002[1]: CVE-2020-16846, CVE-2020-17490, and VE-2020-25592. [1] https://docs.saltstack.com/en/latest/topics/releases/3002.1.html After this VuXML entry is committed, the port will be updated, see PR 251013. - This patch adds a new entry for sysutils/py-salt with all three CVEs described in vuln.xml - There are three flavors of the port, which have to be checked (py36, py37, py38) - 'make validate' is fine with the entry - vxquery shows information as expected ``` #vxquery /usr/ports/security/vuxml/vuln.xml py37-salt-3002_2 Topic: salt -- multiple vulnerabilities Affects: 3002 <= py36-salt < 3002.1 3002 <= py37-salt < 3002.1 3002 <= py38-salt < 3002.1 References: url:https://docs.saltstack.com/en/latest/topics/releases/3002.1.html cvename:CVE-2020-16486 url:https://nvd.nist.gov/vuln/detail/CVE-2020-16746 cvename:CVE-2020-17490 url:https://nvd.nist.gov/vuln/detail/CVE-2020-17490 cvename:CVE-2020-25592 url:https://nvd.nist.gov/vuln/detail/CVE-2020-25592 <URL:http://vuxml.freebsd.org/50259d8b-243e-11eb-8bae-b42e99975750.html> ``` Also '`make VID=50259d8b-243e-11eb-8bae-b42e99975750 html`' renders fine, the links in the html are all functional. What I am not sure about is the range for the vulnerable version. Only version 3002 is vulnerable, not 3001.3 nor 3002.1. I am using '`<range><ge>3002</ge><lt>3002.1</lt></range>`' for this, because I found no working example with `<eq>3002</eq>`.