summaryrefslogtreecommitdiff
path: root/security/putty
AgeCommit message (Collapse)AuthorFilesLines
2022-08-11Bump all dependent packages of wayland (belatedly)gutteridge1-2/+2
The package changed with the addition of its libepoll-shim dependency. Otherwise, we can get: ERROR: libepoll-shim>=0.0.20210418 is not installed; can't buildlink files.
2022-07-17putty: fix build on macOStnn1-1/+6
2021-12-08revbump for icu and libffiadam1-1/+2
2021-10-26security: Replace RMD160 checksums with BLAKE2s checksumsnia1-2/+2
All checksums have been double-checked against existing RMD160 and SHA512 hashes Unfetchable distfiles (fetched conditionally?): ./security/cyrus-sasl/distinfo cyrus-sasl-dedad73e5e7a75d01a5f3d5a6702ab8ccd2ff40d.patch.v2
2021-10-07security: Remove SHA1 hashes for distfilesnia1-2/+1
2021-08-12putty: remove patch that was removed from distinfo during 0.76 updatewiz1-13/+0
2021-07-24putty: Update to 0.67ryoon4-54/+18
Changelog: These features are new in 0.76 (released 2021-07-17): New option to abandon an SSH connection if the server allows you to authenticate in a trivial manner. Bug fix: Windows PuTTY crashed when the 'Use system colours' option was used. Bug fix: crash on Windows when using MIT Kerberos together with 'Restart Session'. Bug fix: Windows PuTTY leaked named pipes after contacting Pageant. Bug fix: Windows PuTTY didn't update the window while you held down the scrollbar arrow buttons long enough to 'key-repeat'. Bug fix: user colour-palette reconfiguration via 'Change Settings' were delayed-action. Bug fix: server colour-palette reconfigurations were sometimes lost. Bug fix: a tight loop could occur on reading a truncated private key file. Bug fix: the Windows Pageant GUI key list didn't display key lengths. These features were new in 0.75 (released 2021-05-08): Security fix: on Windows, a server could DoS the whole Windows GUI by telling the PuTTY window to change its title repeatedly at high speed. Pageant now supports loading a key still encrypted, and decrypting it later by prompting for the passphrase on first use. Upgraded default SSH key fingerprint format to OpenSSH-style SHA-256. Upgraded private key file format to PPK3, with improved passphrase hashing and no use of SHA-1. Terminal now supports ESC [ 9 m for strikethrough text. New protocols: bare ssh-connection layer for use over already-secure IPC channels, and SUPDUP for talking to very old systems such as PDP-10s. PuTTYgen now supports alternative provable-prime generation algorithm for RSA and DSA. The Unix tools can now connect directly to a Unix-domain socket.
2020-11-30Fix Darwin build: set CFLAGS like NetBSD and Linux.schmonz1-1/+2
2020-11-24putty: Fix PuTTY wish pscp-port-0ryoon3-3/+39
https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/pscp-port-0.html
2020-08-18putty: define -DHAVE_NO_SETRESUID on NetBSDtnn1-2/+2
2020-08-17*: revbump after fontconfig bl3 changes (libuuid removal)leot1-1/+2
2020-07-30putty: fix build on Linuxtnn3-16/+8
2020-06-29putty: Update to 0.74ryoon3-22/+7
Changelog: This release fixes the following security issues: - In some situations an SSH server could cause PuTTY to access freed mdmory by pretending to accept an SSH key and then refusing the actual signature. It can only happen if you're using an SSH agent. - New configuration option to disable PuTTY's default policy of changing its host key algorithm preferences to prefer keys it already knows. (There is a theoretical information leak in this policy.) Other bug fixes include: - Windows installer: the text in the installer UI is now visible in Windows high-contrast mode. (Previously it was white on white by mistake.) - Windows 7: fixed spurious OS out-of-memory error when reading passwords from a Windows console (e.g. psftp). - Terminal crash: the dreaded "line==NULL" error could happen if an application switched between the main and alternate screens while the user was looking at the scrollback. - Terminal crash: the terminal could fail an assertion when sending an empty answerback string, and when pasting text none of whose characters exist in the selected character set. - SSH: fixed endless memory-allocating loop that could be triggered by the combination of a misbehaving SSH agent and PuTTY's bug compatibility mode for padded RSA signatures. - File transfer: when uploading files to some SFTP servers (e.g. the one in proftpd's mod_sftp), PSFTP would consume up to 4GB of local memory before sending anything to the server. - Terminal behaviour: sometimes the cursor was put in the wrong place after restoring from the alternate screen. - GTK: fixed font size calculation when using newer Pango libraries (e.g. the one on Ubuntu 20.04). - GTK: scroll wheel events now work in unusual environments like VNC.
2020-03-10librsvg: update bl3.mk to remove libcroco in rust casewiz1-2/+2
recursive bump for the dependency change
2020-03-08*: recursive bump for libffiwiz1-1/+2
2019-12-19Avoid using a non-literal string as format string.joerg2-6/+6
2019-10-01Update to 0.73ryoon5-51/+51
Changelog: Vulnerabilities fixed in this release include: - On Windows, the listening sockets used for local port forwarding were opened in a mode that did not prevent other processes from also listening on the same ports and stealing some of the incoming connections. - In the PuTTY terminal, bracketed paste mode was broken in 0.72, in a way that made the pasted data look like manual keyboard input. So any application relying on the bracketing sequences to protect against malicious clipboard contents would have been misled. - An SSH-1 server could trigger an access to freed memory by sending the SSH1_MSG_DISCONNECT message. Not known to be exploitable. Other bug fixes include: - Windows Plink no longer crashes on startup when it tries to tell you it's reusing an existing SSH connection. - Windows PuTTY now updates its terminal window size correctly if the screen resolution changes while it's maximised. - If you display the coloured error messages from gcc in the PuTTY terminal, there is no longer a missing character if a colour change happens exactly at the end of a line. - If you use the 'Clear Scrollback' menu option or escape sequence while text in the scrollback is selected, it no longer causes an assertion failure.
2019-07-25Update to 0.72ryoon2-8/+8
Changelog: This is a SECURITY UPDATE, fixing vulnerabilities in the obsolete SSH-1 protocol. It also includes many bug fixes over 0.71. We recommend that everybody update. Vulnerabilities fixed in this release include: - A malicious SSH-1 server could trigger a buffer overrun by sending extremely short RSA keys, or certain bad packet length fields. Either of these could happen before host key verification, so even if you trust the server you *intended* to connect to, you would still be at risk. (However, the SSH-1 protocol is obsolete, and recent versions of PuTTY do not try it by default, so you are only at risk if you work with old servers and have explicitly configured SSH-1.) - If a malicious process found a way to impersonate Pageant, then it could cause an integer overflow in any of the SSH client tools (PuTTY, Plink, PSCP, PSFTP) which accessed the malicious Pageant. Other security-related bug fixes include: - The 'trust sigil' system introduced in PuTTY 0.71 to protect against server spoofing attacks had multiple bugs. Trust sigils were not turned off after login in the SSH-1 and Rlogin protocols, and not turned back on if you used the Restart Session command. Both are now fixed. Other bug fixes include: - Kerberos key exchange could crash at the start of an SSH session in the presence of a third-party Windows provider such as MIT Kerberos for Windows, and could also crash if the server sent an ordinary SSH host key as part of the Kerberos exchange. - In SSH-2 keyboard-interactive authentication, one of the message fields sent by the server (namely the 'instructions' message) was accidentally never displayed to the user. - When using SSH-2 connection sharing, pasting text into a downstream PuTTY window that included a line longer than 16Kb could cause that window's connection to be closed. - When using PSCP in old-fashioned SCP mode, downloading files specified by a wildcard could cause a newline character to be appended to the downloaded file names. Also, using the -p option to preserve file times failed with a spurious error message. - On Windows, the numeric keypad key that should generate '.' or ',' depending on keyboard layout was always generating '.'. - RSA keys generated by PuTTYgen could be 1 bit shorter than requested. (Harmless, but a regression in 0.71 compared to 0.70.)
2019-07-21*: recursive bump for gdk-pixbuf2-2.38.1wiz1-1/+2
2019-04-01Update to 0.71ryoon9-127/+57
Changelog: These features were new in 0.70 (released 2017-07-08): Security fix: the Windows PuTTY binaries should no longer be vulnerable to hijacking by specially named DLLs in the same directory, even a name we missed when we thought we'd fixed this in 0.69. See vuln-indirect-dll-hijack-3. Windows PuTTY should be able to print again, after our DLL hijacking defences broke that functionality. Windows PuTTY should be able to accept keyboard input outside the current code page, after our DLL hijacking defences broke that too. These features are new in 0.71 (released 2019-03-16): Security fixes found by an EU-funded bug bounty programme: a remotely triggerable memory overwrite in RSA key exchange, which can occur before host key verification potential recycling of random numbers used in cryptography on Windows, hijacking by a malicious help file in the same directory as the executable on Unix, remotely triggerable buffer overflow in any kind of server-to-client forwarding multiple denial-of-service attacks that can be triggered by writing to the terminal Other security enhancements: major rewrite of the crypto code to remove cache and timing side channels. User interface changes to protect against fake authentication prompts from a malicious server. We now provide pre-built binaries for Windows on Arm. Hardware-accelerated versions of the most common cryptographic primitives: AES, SHA-256, SHA-1. GTK PuTTY now supports non-X11 displays (e.g. Wayland) and high-DPI configurations. Type-ahead now works as soon as a PuTTY window is opened: keystrokes typed before authentication has finished will be buffered instead of being dropped. Support for GSSAPI key exchange: an alternative to the older GSSAPI authentication system which can keep your forwarded Kerberos credentials updated during a long session. More choices of user interface for clipboard handling. New terminal features: support the REP escape sequence (fixing an ncurses screen redraw failure), true colour, and SGR 2 dim text. Pressing Ctrl+Shift+PgUp or Ctrl+Shift+PgDn now takes you straight to the top or bottom of the terminal scrollback.
2018-11-14Revbump after cairo 1.16.0 update.kleink1-2/+2
2018-11-12Recursive revbump from hardbuzz-2.1.1ryoon1-2/+2
2018-08-01putty: fix build after gdk_beep became deprecated.maya4-6/+41
bump pkgrevision for paranoia.
2018-04-16Recursive bump for new fribidi dependency in pango.wiz1-2/+2
2018-03-12Recursive bumps for fontconfig and libzip dependency changes.wiz1-2/+2
2017-11-23recursive bump for libxkbcommon removal from at-spi2-corewiz1-1/+2
2017-09-03Follow some redirects.wiz1-2/+2
2017-05-04Update to 0.69ryoon3-9/+11
* Convert to use GTK 3 to fix build Changelog: These features are new in 0.69 (released 2017-04-29): Security fix: the Windows PuTTY binaries should no longer be vulnerable to hijacking by specially named DLLs in the same directory, even the names we missed when we thought we'd fixed this in 0.68. See vuln-indirect-dll-hijack-2. Windows PuTTY should work with MIT Kerberos again, after our DLL hijacking defences broke it. Jump lists should now appear again on the PuTTY shortcut in the Windows Start Menu. You can now explicitly configure SSH terminal mode settings not to be sent to the server, if your server objects to them.
2017-03-17putty: amend patch to use the BSD syntax on BSDs, and the alternatemaya2-6/+9
syntax otherwise -- it has a better chance of working.
2017-03-17putty: update to 0.68maya7-70/+43
PuTTY 0.68, released today, supports elliptic-curve cryptography for host keys, user authentication keys, and key exchange. Also, for the first time, it comes in a 64-bit Windows version. This update may create a build issue for non-BSD due to ancient functions being different on BSD and SYSV. there's always macros if this fails.
2017-02-12Recursive revbump from fonts/harfbuzzryoon1-2/+2
2017-02-06Recursive bump for harfbuzz's new graphite2 dependency.wiz1-2/+2
2016-08-03Revbump after graphics/gd updateadam1-1/+2
2016-03-14Update to 0.67ryoon2-7/+7
Changelog: 2016-03-05 PuTTY 0.67 released, fixing a SECURITY HOLE PuTTY 0.67, released today, fixes a security hole in 0.66 and before: vuln-pscp-sink-sscanf. It also contains a few other small bug fixes. Also, for the first time, the Windows executables in this release (including the installer) are signed using an Authenticode certificate, to help protect against tampering in transit from our website or after downloading. You should find that they list "Simon Tatham" as the verified publisher.
2015-11-20Update to 0.66ryoon2-9/+8
Changelog: 2015-11-07 PuTTY 0.66 released, fixing a SECURITY HOLE PuTTY 0.66, released today, fixes a security hole in 0.65 and before: vuln-ech-overflow. It also contains a few other small bug fixes and minor features.
2015-11-04Add SHA512 digests for distfiles for security categoryagc1-1/+2
Problems found locating distfiles: Package f-prot-antivirus6-fs-bin: missing distfile fp-NetBSD.x86.32-fs-6.2.3.tar.gz Package f-prot-antivirus6-ws-bin: missing distfile fp-NetBSD.x86.32-ws-6.2.3.tar.gz Package libidea: missing distfile libidea-0.8.2b.tar.gz Package openssh: missing distfile openssh-7.1p1-hpn-20150822.diff.bz2 Package uvscan: missing distfile vlp4510e.tar.Z Otherwise, existing SHA1 digests verified and found to be the same on the machine holding the existing distfiles (morden). All existing SHA1 digests retained for now as an audit trail.
2015-04-25Recursive revbump following MesaLib update, categories p through x.tnn1-1/+2
2015-04-08Update to 0.64ryoon3-8/+21
* Avoid compilation error on tolower and char type. Changelog: 2015-02-28 PuTTY 0.64 released, fixing a SECURITY HOLE PuTTY 0.64, released today, fixes a security hole in 0.63 and before: private-key-not-wiped-2. Also diffie-hellman-range-check has been argued to be a security hole. In addition to these and other less critical bug fixes, 0.64 also supports the major new feature of sharing an SSH connection between multiple instances of PuTTY and its tools, and a command-line and config option to specify the expected host key(s).
2014-05-05Recursive revbump from x11/pixmanryoon1-2/+2
Fix PR pkg/48777
2014-03-06Fix 64bit time_t use. Bump revision.joerg3-3/+25
2013-10-10Recursive revbump from pango-1.36.0ryoon1-2/+2
2013-09-02Revbump after cairo updateadam1-1/+2
2013-08-07update to 0.63drochner12-230/+44
This fixes a buffer overflow which was patched in pkgsrc (CVE-2013-4852), two other buffer overflows (CVE-2013-4206, CVE-2013-4207), and it clears private keys after use now (CVE-2013-4208). Other than that, there are mostly bug fixes from 0.62 and a few small features.
2013-08-06add patch from upstream to fix possible heap overflow in SSH handshakedrochner5-5/+55
due to integer overflow (CVE-2013-4852) bump PKGREV
2013-06-06Bump PKGREVISION for libXft changes for NetBSD native X support onwiz1-2/+2
NetBSD 6, requested by tron.
2013-06-04Try to fix the fallout caused by the fix for PR pkg/47882. Part 3:tron1-2/+2
Recursively bump package revisions again after the "freetype2" and "fontconfig" handling was fixed.
2013-06-03Bump freetype2 and fontconfig dependencies to current pkgsrc versions,wiz1-2/+2
to address issues with NetBSD-6(and earlier)'s fontconfig not being new enough for pango. While doing that, also bump freetype2 dependency to current pkgsrc version. Suggested by tron in PR 47882
2013-02-16Recursive bump for png-1.6.wiz1-2/+2
2012-11-01Don't order function pointers directly. Don't use non-literals as formatjoerg5-7/+50
strings. Fix return type of intermediate used for return value of wcrtomb.
2012-10-23Drop superfluous PKG_DESTDIR_SUPPORT, "user-destdir" is default these days.asau1-3/+1
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-24 00:16:17 +0000