summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2011-07-11update to 2.12.7drochner4-12/+14
changes: -bugfixes -minor feature additions pkgsrc change: since the pkg was changed to build against "nettle" instead of libgcrypt (whether this was a good idea or not...), the latter isn't needed anymore, so remove the stale dependency This can cause build breakage -- in this case addition of a local dependency should restore the old state. (This dependency is technically unnecessary often, but the assumption that gnutls needs libgcrypt is sometimes hardwired in configure scripts and/or code.)
2011-07-11Update to 4.39ryoon5-20/+20
Version 4.39, 2011.07.06, urgency: LOW: New features New Win32 installer module to build self-signed stunnel.pem. Added configuration file editing with Windows GUI. Added log file reopening file editing with Windows GUI. It might be useful to also implement log file rotation. Improved configuration file reload with Windows GUI. Version 4.38, 2011.06.28, urgency: MEDIUM: New features Server-side SNI implemented (RFC 3546 section 3.1) with a new service-level option "nsi". "socket" option also accepts "yes" and "no" for flags. Nagle's algorithm is now disabled by default for improved interactivity. Bugfixes A compilation fix was added for OpenSSL version < 1.0.0. Signal pipe set to non-blocking mode. This bug caused hangs of stunnel features based on signals, e.g. local mode, FORK threading, or configuration file reload on Unix. Win32 platform was not affected. Version 4.37, 2011.06.17, urgency: MEDIUM: New features Client-side SNI implemented (RFC 3546 section 3.1). Default "ciphers" changed from the OpenSSL default to a more secure and faster "RC4-MD5:HIGH:!aNULL:!SSLv2". A paranoid (and usually slower) setting would be "HIGH:!aNULL:!SSLv2". Recommended "options = NO_SSLv2" added to the sample stunnel.conf file. Default client method upgraded from SSLv3 to TLSv1. To connect servers without TLS support use "sslVersion = SSLv3" option. Improved --enable-fips and --disable-fips ./configure option handling. On startup stunnel now compares the compiled version of OpenSSL against the running version of OpenSSL. A warning is logged on mismatch. Bugfixes Non-blocking socket handling in local mode fixed (Debian bug #626856). UCONTEXT threading mode fixed. Removed the use of gcc Thread-Local Storage for improved portability. va_copy macro defined for platforms that do not have it. Fixed "local" option parsing on IPv4 systems. Solaris compilation fix (redefinition of "STR"). Version 4.36, 2011.05.03, urgency: LOW: New features Updated Win32 DLLs for OpenSSL 1.0.0d. Dynamic memory management for strings manipulation: no more static STRLEN limit, lower stack footprint. Strict public key comparison added for "verify = 3" certificate checking mode (thx to Philipp Hartwig). Backlog parameter of listen(2) changed from 5 to SOMAXCONN: improved behavior on heavy load. Example tools/stunnel.service file added for systemd service manager. Bugfixes Missing pthread_attr_destroy() added to fix memory leak (thx to Paul Allex and Peter Pentchev). Fixed the incorrect way of setting FD_CLOEXEC flag. Fixed --enable-libwrap option of ./configure script. /opt/local added to OpenSSL search path for MacPorts compatibility. Workaround implemented for signal handling on MacOS X. A trivial bug fixed in the stunnel.init script. Retry implemented on EAI_AGAIN error returned by resolver calls. Version 4.35, 2011.02.05, urgency: LOW: New features Updated Win32 DLLs for OpenSSL 1.0.0c. Transparent source (non-local bind) added for FreeBSD 8.x. Transparent destination ("transparent = destination") added for Linux. Bugfixes Fixed reload of FIPS-enabled stunnel. Compiler options are now auto-detected by ./configure script in order to support obsolete versions of gcc. Async-signal-unsafe s_log() removed from SIGTERM/SIGQUIT/SIGINT handler. CLOEXEC file descriptor leaks fixed on Linux >= 2.6.28 with glibc >= 2.10. Irreparable race condition leaks remain on other Unix platforms. This issue may have security implications on some deployments: http://udrepper.livejournal.com/20407.html Directory lib64 included in the OpenSSL library search path. Windows CE compilation fixes (thx to Pierre Delaage). Deprecated RSA_generate_key() replaced with RSA_generate_key_ex(). Domain name changes (courtesy of Bri Hatch) http://stunnel.mirt.net/ --> http://www.stunnel.org/ ftp://stunnel.mirt.net/ --> http://ftp.stunnel.org/ stunnel.mirt.net::stunnel --> rsync.stunnel.org::stunnel stunnel-users@mirt.net --> stunnel-users@stunnel.org stunnel-announce@mirt.net --> stunnel-announce@stunnel.org Version 4.34, 2010.09.19, urgency: LOW: New features Updated Win32 DLLs for OpenSSL 1.0.0a. Updated Win32 DLLs for zlib 1.2.5. Updated automake to version 1.11.1 Updated libtool to version 2.2.6b Added ECC support with a new service-level "curve" option. DH support is now enabled by default. Added support for OpenSSL builds with some algorithms disabled. ./configure modified to support cross-compilation. Sample stunnel.init updated based on Debian init script. Bugfixes Implemented fixes in user interface to enter engine PIN. Fixed a transfer() loop issue on socket errors. Fixed missing WIN32 taskbar icon while displaying a global option error.
2011-07-11Update ruby-oauth to 0.4.5.obache3-11/+10
=== 0.4.5 2011-06-25 * Add explicit require for rsa/sha1 (Juris Galang) * Use webmock to mock all http-requests in tests (Adrian Feldman) * Add gemtest support (Adrian Feldman) * Fix POST Requests with Typhoeus proxy (niedhui) * Mention Typhoeus require in the README (Kim Ahlström) * Fix incorrect hardcoded port (Ian Taylor) * Use Net::HTTPGenericRequest (Jakub Kuźma)
2011-07-11-depend on libgcrypt explicitelydrochner2-3/+3
(gnutls used to pull it in for us, but this will be cleaned up) -libgnutls-config isn't needed (uses pkg-config)
2011-07-11+ ruby-twitter_oauthobache1-1/+2
2011-07-11Import ruby-twitter_oauth-0.4.3 as security/ruby-twitter_oauth.obache4-0/+45
twitter_oauth is a Ruby client for the Twitter API using OAuth.
2011-07-08depend on libgcrypt explicitelydrochner3-2/+19
(gnutls used to pull it in for us, but this will be cleaned up) also remove an assumption about time_t size which fails on NetBSD-current
2011-07-08Changes 1.8.4:adam3-40/+18
This is primarily a bugfix release. Fix vulnerabilities: * KDC uninitialized pointer crash [MITKRB5-SA-2010-006 CVE-2010-1322] * kpropd denial of service [MITKRB5-SA-2011-001 CVE-2010-4022] * KDC denial of service attacks [MITKRB5-SA-2011-002 CVE-2011-0281 CVE-2011-0282 CVE-2011-0283] * KDC double-free when PKINIT enabled [MITKRB5-SA-2011-003 CVE-2011-0284] * kadmind frees invalid pointer [MITKRB5-SA-2011-004 CVE-2011-0285] Interoperability: * Correctly encrypt GSSAPI forwarded credentials using the session key, not a subkey. * Set NT-SRV-INST on TGS principal names as expected by some Windows Server Domain Controllers. * Don't reject AP-REQ messages if their PAC doesn't validate; suppress the PAC instead. * Correctly validate HMAC-MD5 checksums that use DES keys
2011-07-08Changes 1.4:adam15-333/+463
New features * Support for reading MIT database file directly * KCM is polished up and now used in production * NTLM first class citizen, credentials stored in KCM * Table driven ASN.1 compiler, smaller!, not enabled by default * Native Windows client support Notes * Disabled write support NDBM hdb backend (read still in there) since it can't handle large records, please migrate to a diffrent backend (like BDB4) Changes 1.3.3: Bug fixes * Check the GSS-API checksum exists before trying to use it [CVE-2010-1321] * Check NULL pointers before dereference them [kdc] Changes 1.3.2: Bug fixes * Don't mix length when clearing hmac (could memset too much) * More paranoid underrun checking when decrypting packets * Check the password change requests and refuse to answer empty packets * Build on OpenSolaris * Renumber AD-SIGNED-TICKET since it was stolen from US * Don't cache /dev/*random file descriptor, it doesn't get unloaded * Make C++ safe * Misc warnings
2011-07-08Changes 0.97.1:adam5-17/+17
This is a bugfix release recommended for all users. Please refer to the ChangeLog file for details.
2011-07-05Add fix for MITKRB5-SA-2011-005 (ftpd fails to setegid from daemon)tez2-2/+18
2011-07-05Fix broken build. Needs explicit -lgcrypt. Add comment to patch-aa.dholland3-3/+21
2011-07-04Correct the fix for http://secunia.com/advisories/44572/tez3-9/+10
See the thread here: http://www.mail-archive.com/openssl-dev@openssl.org/msg29283.html
2011-06-23* set LICENSE=gnu-gpl-v2 # or laterobache1-2/+3
* Allow to build with builtin libevent, because just libevent>=1.0 is required, and builtin libevent version detection was added quite a few years ago. No bump PKGREVISION, because it is impossible to build with libevent-2 from pkgsrc.
2011-06-20add patch from upstream to fix a sign extension problem whichdrochner3-2/+19
breaks blowfish password hashes for non-ASCII characters bump PKGREV
2011-06-19Update sudo package to 1.7.6.2 (1.7.6p2).taca6-36/+37
What's new in Sudo 1.7.6p2 * Two-character CIDR-style IPv4 netmasks are now matched correctly in the sudoers file. * A build error with MIT Kerberos V has been resolved. What's new in Sudo 1.7.6p1 * A non-existent includedir is now treated the same as an empty directory and not reported as an error. * Removed extraneous parens in LDAP filter when sudoers_search_filter is enabled that can cause an LDAP search error.
2011-06-19Add and enable ruby-bcrypt.taca1-1/+2
2011-06-19Importing ruby-bcrypt version 2.1.4 package.taca4-0/+67
bcrypt() is a sophisticated and secure hash algorithm designed by The OpenBSD project for hashing passwords. bcrypt-ruby provides a simple, humane wrapper for safely handling passwords. = bcrypt-ruby An easy way to keep your users' passwords secure. * http://bcrypt-ruby.rubyforge.org/ * http://github.com/codahale/bcrypt-ruby/tree/master == Why you should use bcrypt If you store user passwords in the clear, then an attacker who steals a copy of your database has a giant list of emails and passwords. Some of your users will only have one password -- for their email account, for their banking account, for your application. A simple hack could escalate into massive identity theft. It's your responsibility as a web developer to make your web application secure -- blaming your users for not being security experts is not a professional response to risk. bcrypt allows you to easily harden your application against these kinds of attacks.
2011-06-14Support user-destdir.uebayasi1-30/+35
2011-06-10recursive bump from icu shlib major bump.obache1-2/+2
2011-06-10add a hint for gnupg2 users (as claws-mail with the s/mime plugin)drochner1-1/+10
2011-06-10recursive bump from textproc/icu shlib major bump.obache6-9/+12
2011-06-10Update ruby-roauth to 0.0.7.obache3-8/+7
bug fixes.
2011-06-01Changes 1.6.1:adam4-10/+12
* build: Demand gettext >= 0.18.1 in order to get newer M4 files. The old M4 files associated with 0.17 caused problems on Solaris, which will hopefully be fixed with this. * doc: Typo fix in autoconf snippet. * i18n: Updated translations.
2011-06-01Fix building with Clangadam2-1/+17
2011-05-31Add protection against ECDSA timing attacks as mentioned in the papertez3-3/+31
by Billy Bob Brumley and Nicola Tuveri, see: http://eprint.iacr.org/2011/232.pdf [Billy Bob Brumley and Nicola Tuveri] (patch confirmed in upstream cvs)
2011-05-28DESCR_SRC now contains full paths to DESCR filescheusov1-2/+2
2011-05-28add heirloom-su, oked by sponsorscheusov1-1/+2
2011-05-28heirloom partcheusov3-0/+21
2011-05-27Bump PKGREVISION for dependency removal.wiz1-2/+2
2011-05-27libgnome-keyring 2.32.0 does not depend on eggdbus anymore, according tohans2-4/+2
http://mail.gnome.org/archives/gnome-announce-list/2010-September/msg00101.html
2011-05-27Added support for new 2048 bit FINEID cards.kivinen4-3/+72
2011-05-26* LICENSE=gnu-gpl-v2 # or laterobache3-12/+15
* honor PKGMANDIR * add user-destdir installation support * use ${PERL5} as shebang, not /usr/bin/env. Bump PKGREVISION.
2011-05-25add patch from upstream to make network connections (to fetch CRLs)drochner3-3/+87
non-blocking. Blocking can be considered a DOS problem because other requests are not served in that time. (SA44680, no CVE entry) bump PKGREV
2011-05-20Changes 0.12:adam2-9/+8
* OpenSSL/crypto/x509.c: Add get_extension_count and get_extension to the X509 type, allowing read access to certificate extensions. * OpenSSL/crypto/x509ext.c: Add get_short_name and get_data to the X509Extension type, allowing read access to the contents of an extension. * OpenSSL/ssl/ssl.c: Expose a number of symbolic constants for values passed to the connection "info" callback. * OpenSSL/ssl/connection.py: Add support for new-style buffers (primarily memoryviews) to Connection.send and Connection.sendall.
2011-05-19make this build again on NetBSD-currentdrochner10-19/+150
2011-05-18update to 1.2.18drochner2-7/+6
change: fixes a serious crasher
2011-05-18this pkg only installs binaries -- no need to propagate librarydrochner1-6/+1
dependencies
2011-05-17Don't always try to create ecdsa key which depends on OpenSSL's version.taca2-4/+19
Bump PKGREVISION.
2011-05-16Maintenance of openssh pacakge:taca2-4/+21
1. Add support for check and create ECDSA host key for SSH protocol version 2. 2. Disable use of strnvis(3) on NetBSD. NetBSD current after 2011/03/12 has strnvis(3), but it has different argument from OpenBSD (and other system). Bump PKGREVISION.
2011-05-15Update security/ruby-net-ssh-gateway to version 1.1.0gls2-6/+6
Upstream changes: 1.1.0 / 30 Apr 2011 * Fix for sporadicly stalled SSH connections in Ruby 1.9 [Mat Trudel] * Decrease wait time within Net::SSH session loop [Grant Hutchins, Michael Schubert]
2011-05-15Update security/ruby-net-ssh to version 2.1.4.gls2-6/+6
Upstream changes: 2.1.4 / 3 Apr 2011 * Add ConnectionTimeout exception class. [Joel Watson] See: https://github.com/net-ssh/net-ssh-multi/pull/1 2.1.3 / 2 Mar 2011 * Call to transport.closed should be transport.close [Woon Jung] 2.1.2 / 1 Mar 2011 * Fix for Net::SSH Continues to attempt authentication when notified it is not allowed [Eric Hodel] (see: http://net-ssh.lighthouseapp.com/projects/36253-net-ssh/tickets/26) * Fix for transport won't be closed if authentication fails [Patrick Marchi] 2.1 / 19 Jan 2011 * Support "IdentitiesOnly" directive (LH-24) [Musy Bite, Edmund Haselwanter] * Speeding up the Loggable module (LH-23) [robbebob] 2.0.24 / 14 Jan 2011 * Fix for process code to correctly wait until remote_id is set before sending any output, including eof. [Daniel Pittman, Markus Roberts] * Fix circular require warning in Ruby 1.9.2 [Gavin Brock]
2011-05-15Finish move of tarsnap from security to sysutils.wiz5-47/+1
2011-05-15Update openssh package to 5.8.2 (5.8p2).taca2-7/+7
20110403 - (djm) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec] [contrib/suse/openssh.spec] Prepare for 5.8p2 release. - (djm) [version.h] crank version - Release 5.8p2 20110329 - (djm) [entropy.c] closefrom() before running ssh-rand-helper; leftover fds noticed by tmraz AT redhat.com 20110221 - (dtucker) [contrib/cygwin/ssh-host-config] From Corinna: revamp of the Cygwin-specific service installer script ssh-host-config. The actual functionality is the same, the revisited version is just more exact when it comes to check for problems which disallow to run certain aspects of the script. So, part of this script and the also rearranged service helper script library "csih" is to check if all the tools required to run the script are available on the system. The new script also is more thorough to inform the user why the script failed. Patch from vinschen at redhat com. 20110206 - (dtucker) [openbsd-compat/port-linux.c] Bug #1851: fix syntax error in selinux code. Patch from Leonardo Chiquitto - (dtucker) [contrib/cygwin/ssh-{host,user}-config] Add ECDSA key generation and simplify. Patch from Corinna Vinschen.
2011-05-12Fix building on systems, where ulong is not defined.adam2-3/+14
2011-05-10Remove the REPLACE_PYTHON. It pointed to unused "perl" file.reed1-2/+1
It is not needed since python is ran directly.
2011-05-07Update ruby-simple_oauth to 0.1.5.obache3-10/+11
* Rakefiles are executables, and rake loads rake, not rakefile code * Replace rcov with simplecov * Convert README to Markdown * Convert LICENSE to Markdown * Replace rdoc with yard * Add turn in development for more verbose test output * Trust the load path * Remove vestigial VERSION file * Add Travis configuration file * Bundle setup before running tests * Require rubygems * Add bundler as a development dependency * Apparently, Object#tap was added in 1.8.7, not 1.9 * Add jruby-openssl dependency * Add link to Travis CI * Remove vestigial rdoc options from gem specification * Bump version to 0.1.5
2011-05-06pass --libdir to ./configure to fix lib64 vs lib confusion on linuxalnsn1-1/+2
2011-05-05Fix buildling with Clangadam5-25/+22
2011-05-04SoftHSM 1.2.1 - 2011-05-03pettai3-22/+6
* Backport mutex handling from v2 for increased multithreaded performance. * Remove signature verification used for debugging purposes. (was enabled with ./configure --enable-sigver) * Added an index to the attribute table in the database. * Optimization of the database handling.
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-07 03:09:36 +0000