diff options
| author | schmonz <schmonz@pkgsrc.org> | 2016-12-30 03:21:11 +0000 |
|---|---|---|
| committer | schmonz <schmonz@pkgsrc.org> | 2016-12-30 03:21:11 +0000 |
| commit | 0e027a8c1d90c17fab9e80f226e715925f97e177 (patch) | |
| tree | 3da40345b026230d6a991a176699fa08210d92c5 /www | |
| parent | 59c63f0f79c92e1333adeb4884ff93e286bc77ba (diff) | |
| download | pkgsrc-0e027a8c1d90c17fab9e80f226e715925f97e177.tar.gz | |
Update to 3.20161229. From the changelog:
* Security: force CGI::FormBuilder->field to scalar context where
necessary, avoiding unintended function argument injection
analogous to CVE-2014-1572. In ikiwiki this could be used to
forge commit metadata, but thankfully nothing more serious.
(CVE-2016-9646)
* Security: try revert operations in a temporary working tree before
approving them. Previously, automatic rename detection could result in
a revert writing outside the wiki srcdir or altering a file that the
reverting user should not be able to alter, an authorization bypass.
(CVE-2016-10026 represents the original vulnerability.)
The incomplete fix released in 3.20161219 was not effective for git
versions prior to 2.8.0rc0.
(CVE-2016-9645 represents that incomplete solution.)
* Add CVE references for CVE-2016-10026
* Add automated test for using the CGI with git, including
CVE-2016-10026
- Build-depend on libipc-run-perl for better build-time test coverage
* Add missing ikiwiki.setup for the manual test for CVE-2016-10026
* git: don't issue a warning if the rcsinfo CGI parameter is undefined
* git: do not fail to commit changes with a recent git version
and an anonymous committer
Diffstat (limited to 'www')
| -rw-r--r-- | www/ikiwiki/Makefile | 4 | ||||
| -rw-r--r-- | www/ikiwiki/distinfo | 10 |
2 files changed, 7 insertions, 7 deletions
diff --git a/www/ikiwiki/Makefile b/www/ikiwiki/Makefile index e9b2e9fc792..9479a0101be 100644 --- a/www/ikiwiki/Makefile +++ b/www/ikiwiki/Makefile @@ -1,7 +1,7 @@ -# $NetBSD: Makefile,v 1.144 2016/12/21 00:52:59 schmonz Exp $ +# $NetBSD: Makefile,v 1.145 2016/12/30 03:21:11 schmonz Exp $ # -DISTNAME= ikiwiki_3.20161219 +DISTNAME= ikiwiki_3.20161229 PKGNAME= ${DISTNAME:S/_/-/} CATEGORIES= www textproc MASTER_SITES= ${MASTER_SITE_DEBIAN:=pool/main/i/ikiwiki/} diff --git a/www/ikiwiki/distinfo b/www/ikiwiki/distinfo index eb5713cd59a..ec142e81b42 100644 --- a/www/ikiwiki/distinfo +++ b/www/ikiwiki/distinfo @@ -1,6 +1,6 @@ -$NetBSD: distinfo,v 1.116 2016/12/21 00:52:59 schmonz Exp $ +$NetBSD: distinfo,v 1.117 2016/12/30 03:21:11 schmonz Exp $ -SHA1 (ikiwiki_3.20161219.tar.gz) = b4ea2d1f162290aca7e6e658462d679a5a0e2498 -RMD160 (ikiwiki_3.20161219.tar.gz) = fd3f313f0ef79dc8f6f13624f12075af626f8b5b -SHA512 (ikiwiki_3.20161219.tar.gz) = 2b544c7fcbc878a344f03fa403de784e33a61397d58cc42356ac99ae134bf0b633d63154a9ffac01bc8cca69cdb8e2d23360b95be56d0cd8999264cdb5b7dc3e -Size (ikiwiki_3.20161219.tar.gz) = 3471888 bytes +SHA1 (ikiwiki_3.20161229.tar.gz) = f2727e5594354974c22f83b89388c71d1fa4596f +RMD160 (ikiwiki_3.20161229.tar.gz) = f0a68c45cde83be6a12bf7e699de293df6632a40 +SHA512 (ikiwiki_3.20161229.tar.gz) = dc03450e5f07823d2c8c2fcd0fed9785295b85d9b5c1c0bfc53fde0a11bb9ad0e805b38dd443424d93d5f660551436d52cffe6315b64e2b97f3f8a158afa1b5b +Size (ikiwiki_3.20161229.tar.gz) = 3477477 bytes |