security/vuxml: Pet puppetdb entry

make clean validate reports a missing stanza

security/vuxml:  add entry for net/rabbitmq-c

Sponsored by:   SkunkWerks, GmbH
Security:       CVE-2019-18609
Differential Revision: https://reviews.freebsd.org/D30906

security/vuxml: Document CVE-2021-27021

security/vuxml: Add another package for CVE-2021-3583

Also, fix a copy-paste error. py*-ansible-base are listed twice. The
second entry should list py*-ansible instead.

security/vuxml: Update Ansible's CVE-2021-3583

It turns out that it affects not only ansible-core, but also some other
ports.

security/vuxml: Fix mail/dovecot-pigeonhole vulnerable versions

Correct mail/dovecot-pigeonhole vulnerable versions to proper value.

security/vuxml: Fix CVS name for vid e4cd0b38-c9f9-11eb-87e1-08002750c711

This should fix vuxml.org build.

PR:		256789

security/vuxml: Update the doc link and the comment of where to add new entry

Approved by:	ports-secteam (implicitly)

security/vuxml: Document sysutils/py-ansible-core vulnerability

Security:	CVE-2021-3583

security/vuxml: Fix `make validate` to use the latest vuxml file

This is a follow up for 6954792fe916862afd25cf6ce961bd7062dfb21f

Approved by:	ports-secteam (fluffy)

security/vuxml: Create 2021 entity

Let's create a new entity in the beginning of each year and append to it,
instead of massive copying in the end of each year.

security/vuxml: Fix version range of www/py-aiohttp

This also marks 3.7.4.p0 as fixed.

PR:	256219

security/vuxml: Document mail/dovecot-pigeonhole vulnerability

security/vuxml: Document mail/dovecot vulnerabilities

security/vuxml: Fix range for www/nginx CVE-2021-23017

Reviewed by:	garga
Sponsored by:	Rubicon Communications, LLC ("Netgate")

security/vuxml: Fix 'make validate'

While here, remove hyperlinks to simplify, they can be accessed through
the report's url.

security/vuxml: Add entry for gitea < 1.14.3

PR:		256720

security/vuxml: Add www/chromium < 91.0.4472.114

Obtained
from:	https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-desktop_17.html

security/vuxml: Document CVE-2021-29376 for irc/ircII

PR:		255492
Reported by:	Andrew Gierth <andrew@tao11.riddles.org.uk>

security/vuxml: Document Apache httpd vulns

security/vuxml: document CVE-2021-33564 for rubygem-dragonfly

security/vuxml: Document CVE-2020-35701 for net-mgmt/cacti

security/vuxml: add Chromium < 91.0.4472.101

Obtained
from:	https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-desktop.html

security/vuxml: Document CVE-2021-33896 in net-im/dino port

security/vuxml: Document CVE-2021-3515 for databases/pglogical

A shell injection flaw was found in pglogical in versions before 2.3.4
and before 3.6.26. An attacker with CREATEDB privileges on a
PostgreSQL server can craft a database name that allows execution of
shell commands as the postgresql user when calling
pglogical.create_subscription().

security/vuxml: add www/drupal7 CVE

security/vuxml: document vulnerability in sysutils/polkit

Cedric Buissart reports:

	The function `polkit_system_bus_name_get_creds_sync` is used to get the
	uid and pid of the process requesting the action. It does this by
	sending the unique bus name of the requesting process, which is
	typically something like ":1.96", to `dbus-daemon`. These unique names
	are assigned and managed by `dbus-daemon` and cannot be forged, so this
	is a good way to check the privileges of the requesting process.

	The vulnerability happens when the requesting process disconnects from
	`dbus-daemon` just before the call to
	`polkit_system_bus_name_get_creds_sync` starts. In this scenario, the
	unique bus name is no longer valid, so `dbus-daemon` sends back an error

security/vuxml: Document CVE-2021-33054 for www/sogo*.

PR:		256374
Reported by:	rob2g2 <spam123@bitbert.com>

security/vuxml: Add CVE-2020-8492 for lang/tauthon

PR: 256387
Reported by:	olivier.freebsd@free.fr

security/vuxml: Document CVE-2021-28091 for security/lasso.

PR:		256373
Reported by:	spam123@bitbert.com

security/vuxml: Document lang/go vulnerabilities

security/vuxml: document aiohttp CVE-2021-21330

security/vuxml: Mark zeek < 4.0.2 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v4.0.2

 - Fix potential Undefined Behavior in decode_netbios_name() and
   decode_netbios_name_type() BIFs. The latter has a possibility
   of a remote heap-buffer-overread, making this a potential DoS
   vulnerability.

 - Add some extra length checking when parsing mobile ipv6 packets.
   Due to the possibility of reading invalid headers from remote
   sources, this is a potential DoS vulnerability.

security/vuxml: add entry for PyYAML CVE-2020-14343

PR:		256220

security/vuxml: Fix overly large entry that violates 'make validate'

security/vuxml: Document isc-dhcp44-* vulnerability

PR:		256377

security/vuxml: Document gitlab vulnerabilities.

security/vuxml: Correct CVE entry for the x11/libX11 vulnerability

security/vuxml: document vulnerability in databases/redis

Security:	CVE-2021-32625

security/vuxml: Document vulnerability in x11/libX11

PR:		256034
Security:	CVE-2021-31535

security/vuxml: Document vulnerability in net-mgmt/prometheus2

PR:		255976
Security:	CVE-2021-29622
Approved by:	lwhsu (mentor)

security/vuxml: Document graphics/wayland <= 1.19.0

security/vuxml: add FreeBSD SA-21:12.libradius

security/vuxml: add FreeBSD SA-21:11.smap

vuln.xml: Document chromium < 91.0.4472.77

Obtained
from:	https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html

security/vuxml: Document net/libzmq4 issues

PR:		255102
Reported by:	Thomas Petig <thomas@petig.eu>
Security:	CVE-2019-13132
Security:	CVE-2020-15166

security/vuxml: document vulnerability in www/nginx and www/nginx-devel

Security:	CVE-2021-23017

databases/pg_partman: arbitrary code execution

Security:	CVE-2021-33204

security/vuxml: document vulnerability in texptroc/expat2

Security:	CVE-2013-0340
PR: 		256121

security/vuxml: document vulnerability in texptroc/libxml2

PR:		256093
Security:	CVE-2021-3541

security/vuxml: Add example cvename tag to template

Reviewed by:	riggs
Approved by:	riggs (ports secteam)
Differential Revision:  https://reviews.freebsd.org/D30231

databases/postgresql??-server: multiple security issues

security/vuxml: Add entry for net-im/prosody

PR:	255845, 255849

security/vuxml: declare vulnerabilities for ImageMagick6

PR:		255818

security/vuxml: declare vulnerabilities for ImageMagick7

PR:		255802

security/vuxml: add vunerabilities fixed in 8.2.0

PR:		255361

Document vulnerabilities in Chromium < 90.0.4430.212

Obtained
from:	https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop.html

security/vuxml: Add entry for net-im/py-matrix-synapse

security/vuxml: cyrus-imapd -- Remote authenticated users could bypass intended
access restrictions on c\ertain server annotations.

security/vuxml: Document FLAC out-of-bounds read

security/vuxml: add CVE #s for OpenEXR 2.5.4 fixes

security/vuxml: Document rails vulnerability

security/vuxml: Document lang/go vulnerability

security/vuxml: Document Ansible vulnerability

security/vuxml : Document django's multiple vulnerabilities

Document Python's multiple vulnerabilities

security/vuxml: Update latest MySQL vuln entry

 * Adds CVE numbers
 * Mark MariaDB partially affected

security/vuxml: document recent vulnerabilities with redis ports.
PR:	255580

security/vuxml: Document command injection vulnerability in RDoc

PR:		255552
Reported by:	Yasuhiro Kimura <yasu@utahime.org>
Security:	CVE-2021-31799

security/vuxml: add mail/sympa CVE

PR:		252464

Add an entry about Samba vulnerability CVE-2021-20254:

Negative idmap cache entries can cause incorrect group entries in the Samba file
server process token.

PR:
Submitted by:
Reported by:
Reviewed by:
Approved by:
Obtained from:
MFC after:
MFH:
Relnotes:
Security:	CVE-2021-20254
Sponsored by:
Differential Revision:

security/vuxml: Update fixed version of openoffice-devel.

CVE-2021-30245 is fixed in version 1619649022 of
editors/openoffice-devel.

Document gitlab-ce vulnerabilities.

Document vulnerabilities for www/rubygem-carrierwave.

mail/sympa: add vuxml entry

PR:		255455
Submitted by:	Geoffroy Desvernay <dgeo@centrale-marseille.fr> (maintainer)

Document new vulns, www/chromium < 90.0.4430.93

Obtained
from:	https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html

security/shibboleth.sp: add more information to security advisory

security/shibboleth-sp: add entry for upcoming vulnerability

The details are not yet disclosed.

security/vuxml: Mark zeek < 4.0.1 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v4.0.1

Fix null-pointer dereference when encountering an invalid enum name
in a config/input file that tries to read it into a set[enum]. For
those that have such an input feed whose contents may come from
external/remote sources, this is a potential DoS vulnerability.

security/vuxml: add devel/openvpn < 2.5.2 entry

Security:	CVE-2020-15078
Security:	efb965be-a2c0-11eb-8956-1951a8617e30

Document new vulnerabilities in www/chromium < 90.0.4430.85

Obtained
from:	https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_20.html

Another openssh version fix for CVE-2021-28041.

Reported by:	leres

Document Jenkins Security Advisory 2021-04-20

Sponsored by:	The FreeBSD Foundation

Fix openssh version in entry for CVE-2021-28041

Reported by:	leres

security/vuxml: Add MySQL vulns

security/vuxml: Document OpenOffice vulnerability CVE-2021-30245

devel/maven: update to 3.8.1

This is not just a bugfix as it contains three features that cause a change of
default behavior (external HTTP insecure URLs are now blocked by default): your
builds may fail when using this new Maven release, if you use now blocked
repositories. Please check and eventually fix before upgrading.

Changes http://maven.apache.org/docs/3.8.1/release-notes.html

PR:		255161
Approved by:	Jonathan Chen <jonc@chen.org.nz> (maintainer)
Security:	CVE-2021-26291
		CVE-2020-13956

Document sysutils/consul vulnerabilities

Document accountsservice vulnerability

Document textproc/mdbook vulnerability

Document gitlab vulnerabilities.

Document new vulnerabilities in www/chromium < 90.0.4430.72

Document new vulnerabilities in www/chromium < 89.0.4389.128

Obtained
from:	https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop.html

security/vuxml: Document xorg-server vuln

security/vuxml: Add entry for gitea < 1.14.0

PR:		254976
Submitted by:	Stefan Bethke

security/vuxml: Document syncthing issue

security/vuxml: Document information disclosure vulnerability in python.
PR:		254780
Reported by:	yasu@utahime.org
Security:	CVE-2021-3426

security/vuxml: Document 2 vulnerabilities in ftp/curl
Security:	CVE-2021-22876
		CVE-2021-22890

PR:		254772
Reported by:	yasu@utahime.org

security/vuxml: Add entry for gitea < 1.13.7

PR:	254930
Submitted by:	Stefan Bethke

Document multiple vulnerabilities in security/clamav

PR:		254861
Submitted by:	Yasuhiro Kimura <yasu AT utahime DOT org>