You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by co...@apache.org on 2022/06/10 17:36:45 UTC
[httpd-site] branch main updated: tolerate both flavors of 'released' values
This is an automated email from the ASF dual-hosted git repository.
covener pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/httpd-site.git
The following commit(s) were added to refs/heads/main by this push:
new 7abfe7c tolerate both flavors of 'released' values
7abfe7c is described below
commit 7abfe7c53b7e0fcb49af014c532f3d12329959d7
Author: Eric Covener <ec...@us.ibm.com>
AuthorDate: Fri Jun 10 13:35:56 2022 -0400
tolerate both flavors of 'released' values
diff -ur on generated markdown is the same for me except
CVE-2022-28614 exported from cve.a.o is added
---
content/security/cvejsontohtml.py | 6 ++++--
content/security/json/CVE-2022-28614.json | 14 +++++++-------
2 files changed, 11 insertions(+), 9 deletions(-)
diff --git a/content/security/cvejsontohtml.py b/content/security/cvejsontohtml.py
index e5ff4b7..f860932 100644
--- a/content/security/cvejsontohtml.py
+++ b/content/security/cvejsontohtml.py
@@ -10,6 +10,7 @@ parser.add_option("-e","--extratext",help="extra text to add to description",des
parser.add_option("-i","--inputdirectory",help="directory of json files",dest="directory")
(options,args) = parser.parse_args()
+re_fixedin = re.compile('(released in )?(?P<released>\\d\\.\\d\\.\\d+(-\S+)?)( released)?');
def natural_sort_key(s, _nsre=re.compile('([0-9]+)')):
return [int(text) if text.isdigit() else text.lower()
@@ -33,8 +34,9 @@ for x in os.listdir(options.directory or "./"):
for cve in cves:
for time in cve["timeline"]:
timed = time["value"]
- if ("release" in timed and timed.startswith(filterversion)):
- fixedin = timed.split(" ")[0]
+ matcher = re_fixedin.match(timed);
+ if (matcher and matcher.group('released').startswith(filterversion)):
+ fixedin = matcher.group('released')
if (not fixedin in entries):
entries[fixedin] = []
entries[fixedin].append(cve)
diff --git a/content/security/json/CVE-2022-28614.json b/content/security/json/CVE-2022-28614.json
index 911b151..c47c580 100644
--- a/content/security/json/CVE-2022-28614.json
+++ b/content/security/json/CVE-2022-28614.json
@@ -11,7 +11,7 @@
"DATE_PUBLIC": "",
"TITLE": "read beyond bounds via ap_rwrite() ",
"AKA": "",
- "STATE": "REVIEW"
+ "STATE": "PUBLIC"
},
"source": {
"defect": [],
@@ -67,7 +67,7 @@
"description": {
"description_data": [
{
- "value": "The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function.",
+ "value": "The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function.\n\nModules compiled and distributed separately from Apache HTTP Server that use the \"ap_rputs\" function and may pass it a very large (INT_MAX or larger) string must be compiled against current headers to resolve\nthe issue.",
"lang": "eng"
}
]
@@ -76,7 +76,7 @@
"reference_data": [
{
"refsource": "CONFIRM",
- "url": "",
+ "url": "https://httpd.apache.org/security/vulnerabilities_24.html",
"name": ""
}
]
@@ -108,15 +108,15 @@
"CVE_list": [],
"internal_comments": "",
"todo": [],
- "emailed": "",
- "userslist": "",
+ "emailed": "yes",
+ "userslist": "dev@httpd.apache.org",
"email": ""
},
"timeline": [
{
- "lang": "eng",
"time": "2022-06-08",
- "value": "2.4.54 released"
+ "lang": "eng",
+ "value": "released in 2.4.54"
}
]
}