In contrast to ports-mgmt/portaudit, which is designed to be an
install-and-forget solution, portaudit-db requires a current
ports tree and generates a database that can be used locally
or distributed over a network.
Furthermore committers that want to add entries to the VuXML
database may use this port to check their changes locally.
It also features a file `database/portaudit.txt' where UUIDs
for vulnerabilities can be allocated before they have been
investigated thoroughly and moved to the VuXML database by
the security officer team.
Call `packaudit' after upgrading your ports tree.
WWW: http://people.freebsd.org/~eik/portaudit/
Oliver Eikemeier <eik@FreeBSD.org>
Retire ports-mgmt/portaudit, it stopped working a month ago when pkg_tools
support was removed. Also retire three ports requiring it, and a few optionnal
dependencies.
With hat: portmgr
Noticed by: ak
Sponsored by: Absolight
- Remove the system-related section for this vulnerability as it is incorrectly
matching on all versions of FreeBSD. (It is also already documented in
vuln.xml, so we are not losing information)
With hat: ports-secteam@
Move the sourcing of packaudit.conf higher up in the tree
so that for examplee DATABASEDIR can be specified there and
is not "ignored"
PR: 135471
Submitted by: John Marshall <john@rwsrv05.mby.riverwillow.net.au>
Discussed with: des
Packaudit: switch to Subversion
- use links to Subversion tree, HTTPS-flavored ones;
- extract revision using Subversion format of $FreeBSD$;
- refuse to work with vuln.xml that comes from CVS:
automated exporter is switched off, so this source of
vulnerabilities is stale.
Reviewed by: simon, bz (partly), gavin
Approved by: portmgr (tabthorpe), so (des), secteam (simon)
Remove 2004 aspell entry that has long since been dealt with.
The format of the entry incorrectly matched dictionaries that
could not possibly be vulnerable to the buffer overflow issue.
Approved by: simon
Remove entry 2de14f7a-dad9-11d8-b59a-00061bc2ad93 (Multiple
Potential Buffer Overruns in Samba) which is duplicated from
vuln.xml. I don't know why this entry is duplicated here, but I
suspect it's related to portaudit.txt.
By removing the entry from here, the entry in vuln.xml should
just be used instead.
PR: ports/129240
Reported by: Eygene Ryabinkin <rea-fbsd@codelabs.ru>
