summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2011-08-11Changes 1.3.1:adam8-61/+35
* Ported to Windows CE. * Detect GPG versions not supporting ---passwd.
2011-08-11Changes 2.12.8:adam4-22/+21
* libgnutls: PKCS-11 back-end was replaced by p11-kit * libgnutls: gcrypt: replaced occurences of gcry_sexp_nth_mpi (..., 0) with gcry_sexp_nth_mpi (..., GCRYMPI_FMT_USG) to fix errors with 1.5.0. * libgnutls: Verify that a certificate liste specified using gnutls_certificate_set_x509_key*(), is sorted according to TLS specification * libgnutls: Added GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED flag for gnutls_x509_crt_list_import. It checks whether the list to be imported is properly sorted. * libgnutls: writev_emu: stop on the first incomplete write. * libgnutls: Fix zlib handling in gnutls.pc. * certtool: bug fixes in certificate request generation. * API and ABI modifications: GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED: New element in gnutls_certificate_import_flags
2011-08-11Changes 2.0.18:adam2-7/+6
* Bug fix for newer versions of Libgcrypt. * Support the SSH confirm flag and show SSH fingerprints in ssh related pinentries. * Improved dirmngr/gpgsm interaction for OCSP. * Allow generation of card keys up to 4096 bit.
2011-08-11Changes 2.0.2:adam2-7/+6
* A new flag may now be used to convey comments via assuan_transact. * A new flag value may now be used to disable logging. * The gpgcedev.c driver now provides a log device. * It is now possible to overwrite socket and connect functions in struct assuan_system_hooks.
2011-08-10Add a patch to avoid SSP side effect as NetBSD current.taca2-2/+22
Bump PKGREVISION.
2011-08-10fix the last change of DEPENDS pattern for p5-Digest-SHA.obache1-2/+2
PR#45228.
2011-08-09As noted in Changes 1.03, depend on p5-Digest-SHA instead of p5-Digest-SHA1.obache1-2/+2
2011-08-09Changes 0.02:adam2-17/+16
* Fixed a bug affecting input strings with an odd number of characters. Thanks to Ken T Takusagawa for the report. * Cleaned up Makefile.PL. * Removed magic svn keywords. * Added author tests (xt/) and modified SYNOPSIS for all modules to make them pass the compilation test.
2011-08-09Revision bump after updating perl to 5.14.1adam2-5/+5
2011-08-09Changes 1.03:adam2-18/+16
* Depend on Digest::SHA instead of Digest::SHA1 * Document the blocksize argument
2011-08-09Revision bump after updating perl to 5.14.1adam5-29/+30
2011-08-09Changes 5.62:adam2-16/+13
* removed unnecessary loading of MIME::Base64 module Changes 5.61: * corrected bug in 'algorithm' method * fixed -x option in Makefile.PL -- not often used since it deliberately excludes all 64-bit SHA transforms * addressed minor documentation oversights Changes 5.60: * added new SHA-512/224 and SHA-512/256 transforms -- ref. NIST Draft FIPS 180-4 (February 2011) * simplified shasum by removing duplicative text * improved efficiency of Addfile -- expensive -T test now occurs only in portable mode Changes 5.50: * adopted convention that '-' always means STDIN -- actual filename '-' accessed as './-' -- accords with behavior of sha1sum/md5sum * corrected undefined subroutine oversight in shasum -- inadvertent migration of _bail() from SHA.pm
2011-08-09Revision bump after updating perl to 5.14.1adam2-15/+13
2011-08-02Deal with c99 inline semantics.joerg3-1/+63
2011-08-02Fix prototype.joerg2-1/+15
2011-07-31Adds the symbols _kdc_db_fetch and _kdc_free_ent to globalgls3-2/+21
visibility, so that they can be referenced from kdc/digest-service. Fixes build on Dragonfly. From Alex Hornung in PR pkg/45195.
2011-07-28Changes since 1.6.0:pettai2-7/+9
* [SANTUARIO-268] - TXFMXPathFilter->evaluateExpr crashes on Windows * [SANTUARIO-270] - DSIGObject::load method crashes for ds:Object without Id att ribute * [SANTUARIO-271] - Bug when signing files with big RSA keys * [SANTUARIO-272] - Memory bug inside XENCCipherImpl::deSerialise * [SANTUARIO-274] - Function cleanURIEscapes always throws XSECException, when a ny escape sequence occurs * [SANTUARIO-275] - Function isHexDigit doesn't recognize invalid escape sequenc es. * [SANTUARIO-276] - Percent-encoded multibyte (UTF-8) sequences unrecognized * [SANTUARIO-280] - RSA-OAEP handler only allows SHA-1 digests
2011-07-28Update fixes CVE-2011-2516pettai3-9/+8
(See http://shibboleth.internet2.edu/secadv/secadv_20110706.txt for details)
2011-07-27Change MASTER_SITES to the new distribution pointpettai1-2/+2
2011-07-27Delete patch that is not neededpettai2-17/+1
2011-07-271.10:pettai3-8/+154
- New Features: - New Apps: (see the validator/apps directory for details) - dnssec-check: check dnssec support from your ISP - dnssec-nodes: graphically displays a DNS hierarchy, color coded by each node's DNSSEC status - dnssec-system-tray: displays pop-up notifications when a libval-enabled application triggers a DNSSEC error - lookup: a graphical DNS lookup utility that displays the results in a hierarchical tree and color codes the window according to DNSSEC status - libval: - Added support for building on Windows. - added support for falling back to recursion when the caching name server does not appear to support DNSSEC. This also works as a mechanism to work around poisoned or misbehaving cache. - Significant improvements to the the asynchronous support. - lsdnssec: - Improvements to lsdnssec to display different output depending on whether a zone is a stand-alone zone or under control of rollerd. - nagios: - Plugins for the nagios monitoring system which enable monitoring of zone rollerover states. - firefox: - Improved patches that work with the most recent firefox Plus many more minor features and bug fixes 1.9: - New Features: - lsdnssec: - Added a new flag (-p) to show only zones in a particular rollerd phase. - fixed bugs to align timing output with rollerd. - rollerd: - Added a -logtz flag for logging timezones - fixed bugs related to the -alwayssign flag. - zonesigner's path is taken from the config file. - rollctl: - Added -rollall and -rollzone options. - zonesigner: - Assumes keys need to be generated for new zones (Assumes -genkeys option was given if a keyrec file can't be found.) - Exits with unique exit codes if a failure occurs. ("zonesigner -xc CODE" can lookup a description for it.") - Added the -phase option so rollover options could be more easily specified. - lights: - A simple GUI to check the status of rollover states - blinkenlights:- Added hide/show commands for rollrec names and zone names, for split-zone support - cleankrf: - Fixed deletion of obsolete set keyrecs. - GUI commands: - Fixed how the Exit command works so they don't coredump. - libsres & libval: - New beta support for issuing asynchronous requests. This can speed up queries by up to 4 times if used. (see example code in validator/apps/validator_selftest.c) - NSEC3, DLV and IPv6 are enabled by default. - improved logging and logging-callback support. - drawvalmap - Can output PNG files now - Packaging: - Our download page now allows you to download the C validator libraries independently of the full DNNSEC-Tools tool-suite. - Many bugs were also fixed in the 240+ changes.
2011-07-27OpenDNSSEC 1.3.0pettai3-9/+8
* Include simple-dnskey-mailer-plugin in dist. * Enforcer: Change message about KSK retirement to make it less confusing. Bugfixes: * ods-control: If the Enforcer did not close down, you entered an infinite loop. * Signer Engine: Fix log message typos. * Signer Engine: Fix crash where ods-signer update * Signer Engine: Also replace DNSKEYs if <DNSKEY><TTL> has changed in policy. * Zonefetcher: Sometimes invalid 'Address already in use' occurred. * Bugfix #247: Fixes bug introduced by bugfix #242. OpenDNSSEC 1.3.0rc3 * Do not distribute trang. Bugfixes: * Fix test for java executable and others. * Auditor: Fix delegation checks. * Bugfix #242: Race condition when receiving multiple NOTIFIES for a zone. * ods-kaspcheck: Do not expect resalt in NSEC policy. * Signer Engine: Ifdef a header file. * Signer Engine: The default working directory was not specified. * Signer Engine: Handle stdout console output throttling that would truncate daemon output intermittently. OpenDNSSEC 1.3.0.rc2 * Match the names of the signer pidfile and enforcer pidfile. * Include check for resign < resalt in ods-kaspcheck. Bugfixes: * Bugfix #231: Fix MySQL version check. * ods-ksmutil: Update now sends a HUP to the enforcerd. * Signer Engine: Fix assertion failure if zone was just added. * Signer Engine: Don't hsm_close() on setup error. * Signer Engine: Fix race condition bug when doing a single run. * Signer Engine: In case of failure, also mark zone processed (single run). * Signer Engine: Don't leak backup file descriptor. * signconf.rnc now allows NSEC3 Iterations of 0 OpenDNSSEC 1.3.0rc1 * <SkipPublicKey/> is enabled for SoftHSM in the default configuration. It improves the performance by only using the private key objects. * Document the <RolloverNotification> tag in conf.xml. Bugfixes: * Bugfix #221: Segmentation Fault on schedule.c:232 * Enforcer: 'make check' now works. * Enforcer: Fixed some memory leaks in the tests. * Signer Engine: Coverity report fixes some leaks and thread issues. * Signer Engine: Now logs to the correct facility again. OpenDNSSEC 1.3.0b1 * Support for signing the root. Use the zone name "." * Enforcer: Stop import of policy if it is not consistent. * ods-signer: The queue command will now also show what tasks the workers are working on. * Signer Engine: Just warn if occluded zone data was found, don't stop signing p rocess. * Signer Engine: Simpler serial maintenance, reduces the number of conflicts. Less chance to hit a 'cannot update: serial too small' error message. * Signer Engine: Simpler NSEC(3) maintenance. * Signer Engine: Temperate the number of backup files. * Signer Engine: Set number of <SignerThreads> in conf.xml to get peak performance from HSMs that can handle multiple threads. Bugfixes: * Bugreport #139: ods-auditor fails on root zone. * Bugreport #198: Zone updates ignored? * Replace tab with white-space when writing to syslog. * Signer Engine: Do not block update command while signing.
2011-07-25Changes 0.97.2adam2-6/+6
ClamAV 0.97.2 fixes problems with the bytecode engine, Safebrowsing detection, hash matcher, and other minor issues. Please see the ChangeLog file for details.
2011-07-22Update py-paramiko to 1.7.7.1.obache3-21/+9
various bug fixes; requires pycrypto 2.1. or newer
2011-07-21recursive bump from gnome-vfs drop crypto dependency.obache3-6/+6
2011-07-16Regenerate checksum for patches.asau1-2/+2
2011-07-15disable AESNI support for now, until we have a method to tell whetherdrochner1-1/+2
the assembler supports the needed SSE commands, to allow building on NetBSD-5, in response to a report by Marc Baudoin to pkgsrc-users
2011-07-14propagate libtasn1 dependency, should fix seahorse build failuredrochner1-1/+2
reported by Ryo ONODERA per PR pkg/45144
2011-07-14Fixes PKGCONFIG_OVERRIDE settings:obache1-5/+4
* No need to prefix with ${WRKSRC}. * It must not be overwritten multiple time, or only last one will be activate. * library/gnome-keyring part is now in separate libgnome-keyring package. Bump PKGREVISION.
2011-07-14Re-add entries for gcrypt.tar.bz2 which neede by idea PKG_OPTIONS.taca1-1/+4
2011-07-13Changes 1.5.0:adam12-53/+88
* New function gcry_kdf_derive implementing OpenPGP S2K algorithms and PBKDF2. * Support for WindowsCE. * Support for ECDH. * Support for OAEP and PSS methods as described by RFC-3447. * Fixed PKCS v1.5 code to always return the leading zero. * New format specifiers "%M" and "%u" for gcry_sexp_build. * Support opaque MPIs with "%m" and "%M" in gcry_sexp_build. * New functions gcry_pk_get_curve and gcry_pk_get_param to map ECC parameters to a curve name and to retrieve parameter values. * gcry_mpi_cmp applied to opaque values has a defined semantic now. * Uses the Intel AES-NI instructions if available. * The use of the deprecated Alternative Public Key Interface (gcry_ac_*) will now print compile time warnings. * The module register subsystem has been deprecated. This subsystem is not flexible enough and would always require ABI changes to extend the internal interfaces. It will eventually be removed. Please contact us on the gcrypt-devel mailing list to discuss whether you really need this feature or how it can be replaced by an internal plugin mechanism. * CTR mode may now be used with data chunks of arbitrary length.
2011-07-11update to 2.12.7drochner4-12/+14
changes: -bugfixes -minor feature additions pkgsrc change: since the pkg was changed to build against "nettle" instead of libgcrypt (whether this was a good idea or not...), the latter isn't needed anymore, so remove the stale dependency This can cause build breakage -- in this case addition of a local dependency should restore the old state. (This dependency is technically unnecessary often, but the assumption that gnutls needs libgcrypt is sometimes hardwired in configure scripts and/or code.)
2011-07-11Update to 4.39ryoon5-20/+20
Version 4.39, 2011.07.06, urgency: LOW: New features New Win32 installer module to build self-signed stunnel.pem. Added configuration file editing with Windows GUI. Added log file reopening file editing with Windows GUI. It might be useful to also implement log file rotation. Improved configuration file reload with Windows GUI. Version 4.38, 2011.06.28, urgency: MEDIUM: New features Server-side SNI implemented (RFC 3546 section 3.1) with a new service-level option "nsi". "socket" option also accepts "yes" and "no" for flags. Nagle's algorithm is now disabled by default for improved interactivity. Bugfixes A compilation fix was added for OpenSSL version < 1.0.0. Signal pipe set to non-blocking mode. This bug caused hangs of stunnel features based on signals, e.g. local mode, FORK threading, or configuration file reload on Unix. Win32 platform was not affected. Version 4.37, 2011.06.17, urgency: MEDIUM: New features Client-side SNI implemented (RFC 3546 section 3.1). Default "ciphers" changed from the OpenSSL default to a more secure and faster "RC4-MD5:HIGH:!aNULL:!SSLv2". A paranoid (and usually slower) setting would be "HIGH:!aNULL:!SSLv2". Recommended "options = NO_SSLv2" added to the sample stunnel.conf file. Default client method upgraded from SSLv3 to TLSv1. To connect servers without TLS support use "sslVersion = SSLv3" option. Improved --enable-fips and --disable-fips ./configure option handling. On startup stunnel now compares the compiled version of OpenSSL against the running version of OpenSSL. A warning is logged on mismatch. Bugfixes Non-blocking socket handling in local mode fixed (Debian bug #626856). UCONTEXT threading mode fixed. Removed the use of gcc Thread-Local Storage for improved portability. va_copy macro defined for platforms that do not have it. Fixed "local" option parsing on IPv4 systems. Solaris compilation fix (redefinition of "STR"). Version 4.36, 2011.05.03, urgency: LOW: New features Updated Win32 DLLs for OpenSSL 1.0.0d. Dynamic memory management for strings manipulation: no more static STRLEN limit, lower stack footprint. Strict public key comparison added for "verify = 3" certificate checking mode (thx to Philipp Hartwig). Backlog parameter of listen(2) changed from 5 to SOMAXCONN: improved behavior on heavy load. Example tools/stunnel.service file added for systemd service manager. Bugfixes Missing pthread_attr_destroy() added to fix memory leak (thx to Paul Allex and Peter Pentchev). Fixed the incorrect way of setting FD_CLOEXEC flag. Fixed --enable-libwrap option of ./configure script. /opt/local added to OpenSSL search path for MacPorts compatibility. Workaround implemented for signal handling on MacOS X. A trivial bug fixed in the stunnel.init script. Retry implemented on EAI_AGAIN error returned by resolver calls. Version 4.35, 2011.02.05, urgency: LOW: New features Updated Win32 DLLs for OpenSSL 1.0.0c. Transparent source (non-local bind) added for FreeBSD 8.x. Transparent destination ("transparent = destination") added for Linux. Bugfixes Fixed reload of FIPS-enabled stunnel. Compiler options are now auto-detected by ./configure script in order to support obsolete versions of gcc. Async-signal-unsafe s_log() removed from SIGTERM/SIGQUIT/SIGINT handler. CLOEXEC file descriptor leaks fixed on Linux >= 2.6.28 with glibc >= 2.10. Irreparable race condition leaks remain on other Unix platforms. This issue may have security implications on some deployments: http://udrepper.livejournal.com/20407.html Directory lib64 included in the OpenSSL library search path. Windows CE compilation fixes (thx to Pierre Delaage). Deprecated RSA_generate_key() replaced with RSA_generate_key_ex(). Domain name changes (courtesy of Bri Hatch) http://stunnel.mirt.net/ --> http://www.stunnel.org/ ftp://stunnel.mirt.net/ --> http://ftp.stunnel.org/ stunnel.mirt.net::stunnel --> rsync.stunnel.org::stunnel stunnel-users@mirt.net --> stunnel-users@stunnel.org stunnel-announce@mirt.net --> stunnel-announce@stunnel.org Version 4.34, 2010.09.19, urgency: LOW: New features Updated Win32 DLLs for OpenSSL 1.0.0a. Updated Win32 DLLs for zlib 1.2.5. Updated automake to version 1.11.1 Updated libtool to version 2.2.6b Added ECC support with a new service-level "curve" option. DH support is now enabled by default. Added support for OpenSSL builds with some algorithms disabled. ./configure modified to support cross-compilation. Sample stunnel.init updated based on Debian init script. Bugfixes Implemented fixes in user interface to enter engine PIN. Fixed a transfer() loop issue on socket errors. Fixed missing WIN32 taskbar icon while displaying a global option error.
2011-07-11Update ruby-oauth to 0.4.5.obache3-11/+10
=== 0.4.5 2011-06-25 * Add explicit require for rsa/sha1 (Juris Galang) * Use webmock to mock all http-requests in tests (Adrian Feldman) * Add gemtest support (Adrian Feldman) * Fix POST Requests with Typhoeus proxy (niedhui) * Mention Typhoeus require in the README (Kim Ahlström) * Fix incorrect hardcoded port (Ian Taylor) * Use Net::HTTPGenericRequest (Jakub Kuźma)
2011-07-11-depend on libgcrypt explicitelydrochner2-3/+3
(gnutls used to pull it in for us, but this will be cleaned up) -libgnutls-config isn't needed (uses pkg-config)
2011-07-11+ ruby-twitter_oauthobache1-1/+2
2011-07-11Import ruby-twitter_oauth-0.4.3 as security/ruby-twitter_oauth.obache4-0/+45
twitter_oauth is a Ruby client for the Twitter API using OAuth.
2011-07-08depend on libgcrypt explicitelydrochner3-2/+19
(gnutls used to pull it in for us, but this will be cleaned up) also remove an assumption about time_t size which fails on NetBSD-current
2011-07-08Changes 1.8.4:adam3-40/+18
This is primarily a bugfix release. Fix vulnerabilities: * KDC uninitialized pointer crash [MITKRB5-SA-2010-006 CVE-2010-1322] * kpropd denial of service [MITKRB5-SA-2011-001 CVE-2010-4022] * KDC denial of service attacks [MITKRB5-SA-2011-002 CVE-2011-0281 CVE-2011-0282 CVE-2011-0283] * KDC double-free when PKINIT enabled [MITKRB5-SA-2011-003 CVE-2011-0284] * kadmind frees invalid pointer [MITKRB5-SA-2011-004 CVE-2011-0285] Interoperability: * Correctly encrypt GSSAPI forwarded credentials using the session key, not a subkey. * Set NT-SRV-INST on TGS principal names as expected by some Windows Server Domain Controllers. * Don't reject AP-REQ messages if their PAC doesn't validate; suppress the PAC instead. * Correctly validate HMAC-MD5 checksums that use DES keys
2011-07-08Changes 1.4:adam15-333/+463
New features * Support for reading MIT database file directly * KCM is polished up and now used in production * NTLM first class citizen, credentials stored in KCM * Table driven ASN.1 compiler, smaller!, not enabled by default * Native Windows client support Notes * Disabled write support NDBM hdb backend (read still in there) since it can't handle large records, please migrate to a diffrent backend (like BDB4) Changes 1.3.3: Bug fixes * Check the GSS-API checksum exists before trying to use it [CVE-2010-1321] * Check NULL pointers before dereference them [kdc] Changes 1.3.2: Bug fixes * Don't mix length when clearing hmac (could memset too much) * More paranoid underrun checking when decrypting packets * Check the password change requests and refuse to answer empty packets * Build on OpenSolaris * Renumber AD-SIGNED-TICKET since it was stolen from US * Don't cache /dev/*random file descriptor, it doesn't get unloaded * Make C++ safe * Misc warnings
2011-07-08Changes 0.97.1:adam5-17/+17
This is a bugfix release recommended for all users. Please refer to the ChangeLog file for details.
2011-07-05Add fix for MITKRB5-SA-2011-005 (ftpd fails to setegid from daemon)tez2-2/+18
2011-07-05Fix broken build. Needs explicit -lgcrypt. Add comment to patch-aa.dholland3-3/+21
2011-07-04Correct the fix for http://secunia.com/advisories/44572/tez3-9/+10
See the thread here: http://www.mail-archive.com/openssl-dev@openssl.org/msg29283.html
2011-06-23* set LICENSE=gnu-gpl-v2 # or laterobache1-2/+3
* Allow to build with builtin libevent, because just libevent>=1.0 is required, and builtin libevent version detection was added quite a few years ago. No bump PKGREVISION, because it is impossible to build with libevent-2 from pkgsrc.
2011-06-20add patch from upstream to fix a sign extension problem whichdrochner3-2/+19
breaks blowfish password hashes for non-ASCII characters bump PKGREV
2011-06-19Update sudo package to 1.7.6.2 (1.7.6p2).taca6-36/+37
What's new in Sudo 1.7.6p2 * Two-character CIDR-style IPv4 netmasks are now matched correctly in the sudoers file. * A build error with MIT Kerberos V has been resolved. What's new in Sudo 1.7.6p1 * A non-existent includedir is now treated the same as an empty directory and not reported as an error. * Removed extraneous parens in LDAP filter when sudoers_search_filter is enabled that can cause an LDAP search error.
2011-06-19Add and enable ruby-bcrypt.taca1-1/+2
2011-06-19Importing ruby-bcrypt version 2.1.4 package.taca4-0/+67
bcrypt() is a sophisticated and secure hash algorithm designed by The OpenBSD project for hashing passwords. bcrypt-ruby provides a simple, humane wrapper for safely handling passwords. = bcrypt-ruby An easy way to keep your users' passwords secure. * http://bcrypt-ruby.rubyforge.org/ * http://github.com/codahale/bcrypt-ruby/tree/master == Why you should use bcrypt If you store user passwords in the clear, then an attacker who steals a copy of your database has a giant list of emails and passwords. Some of your users will only have one password -- for their email account, for their banking account, for your application. A simple hack could escalate into massive identity theft. It's your responsibility as a web developer to make your web application secure -- blaming your users for not being security experts is not a professional response to risk. bcrypt allows you to easily harden your application against these kinds of attacks.
2011-06-14Support user-destdir.uebayasi1-30/+35
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-18 08:03:30 +0000