Re: net/rsync: CVE-2022-29154 fix

2022-08-06 Thread Stuart Henderson
If we are going to do something in advance of their release I'd prefer pre1 than a patch as at least it will be more obvious to the user from the version number. Changing MASTER_SITES like that will prevent portroach from picking up new normal releases (which seems particularly important given

Re: net/rsync: CVE-2022-29154 fix

2022-08-05 Thread Nam Nguyen
"T.J. Townsend" writes: >> https://www.openwall.com/lists/oss-security/2022/08/02/1 >> https://github.com/WayneD/rsync/commit/b7231c7d02.patch Here is a diff that updates to 3.2.5pre1 to cover tj@'s backported fix + additional related fixes. This way, no local patches are needed. I am a bit conce

Re: net/rsync: CVE-2022-29154 fix

2022-08-05 Thread T.J. Townsend
> https://www.openwall.com/lists/oss-security/2022/08/02/1 > https://github.com/WayneD/rsync/commit/b7231c7d02.patch Updated diff that also fixes CVE-2022-37434 in the bundled zlib: Index: Makefile === RCS file: /cvs/ports/net/rsync/

Re: net/rsync: CVE-2022-29154 fix

2022-08-02 Thread Stuart Henderson
On 2022/08/02 10:10, T.J. Townsend wrote: > https://www.openwall.com/lists/oss-security/2022/08/02/1 > https://github.com/WayneD/rsync/commit/b7231c7d02.patch https://lists.samba.org/archive/rsync/2022-August/032838.html :- "I'd really appreciate it if people would give this release some

net/rsync: CVE-2022-29154 fix

2022-08-02 Thread T.J. Townsend
https://www.openwall.com/lists/oss-security/2022/08/02/1 https://github.com/WayneD/rsync/commit/b7231c7d02.patch Index: Makefile === RCS file: /cvs/ports/net/rsync/Makefile,v retrieving revision 1.93 diff -u -p -r1.93 Makefile --- Mak