BSD PortsVaultwarden -- multiple vulnerabilities
The Vaultwarden project reports: SSRF via the icon endpoint [GHSA-hw4g-2v3f-74x5] [GHSA-vh5m-fc9v-m84g] (Medium, 5.8 / 6.3) Cross-Organization Cipher Access [GHSA-xwf8-pjh7-h589] (Medium, 5.9) Organization Policy Bypass on Directory Import [GHSA-88qc-6ch9-mc3j] (Medium, 5.5) Send Access-Count Bypass [GHSA-rxhg-2pw9-vf25] (Medium, 5.3) Unauthenticated WebSocket Flooding DDOS [GHSA-96f7-78q5-j345] (Medium, 5.3) …
Affected versions
- vaultwarden < 1.37.0
By system
0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | security/vaultwarden | 1.37.4_1 | fixed | (4 days after) |
| OpenBSD | security/vaultwarden | 1.37.4 | out of range, by version | |
| NetBSD | security/vaultwarden | 1.37.2 | not listed |