summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2016-06-08Update OpenDNSSEC to version 1.4.10.he3-20/+11
News: This release fix targets stability issues which have had a history and had been hard to reproduce. Stability should be improved, running OpenDNSSEC as a long term service. Changes in TTL in the input zone that seem not to be propagated, notifies to slaves under load that where not handled properly and could lead to assertions. NSEC3PARAM that would appear duplicate in the resulting zone, and crashes in the signer daemon in seldom race conditions or re-opening due to a HSM reset. No migration steps needed when upgrading from OpenDNSSEC 1.4.9. Also have a look at our OpenDNSSEC 2.0 beta release, its impending release will help us forward with new development and signal phasing out historic releases. Fixes: * SUPPORT-156 OPENDNSSEC-771: Multiple NSEC3PARAM records in signed zone. After a resalt the signer would fail to remove the old NSEC3PARAM RR until a manual resign or incoming transfer. Old NSEC3PARAMS are removed when inserting a new record, even if they look the same. * OPENDNSSEC-725: Signer did not properly handle new update while still distributing notifies to slaves. An AXFR disconnect looked not to be handled gracefully. * SUPPORT-171: Signer would sometimes hit an assertion using DNS output adapter when .ixfr was missing or corrupt but .backup file available. Above two issues also in part addresses problems with seemingly corrected backup files (SOA serial). Also an crash on badly configured DNS output adapters is averted. * The signer daemon will now refuse to start when failed to open a listen socket for DNS handling. * OPENDNSSEC-478 OPENDNSSEC-750 OPENDNSSEC-581 OPENDNSSEC-582 SUPPORT-88: Segmentation fault in signer daemon when opening and closing hsm multiple times. Also addresses other concurrency access by avoiding a common context to the HSM (a.k.a. NULL context). * OPENDNSSEC-798: Improper use of key handles across hsm reopen, causing keys not to be available after a re-open. * SUPPORT-186: IXFR disregards TTL changes, when only TTL of an RR is changed. TTL changes should be treated like any other changes to records. When OpenDNSSEC now overrides a TTL value, this is now reported in the log files.
2016-06-08Try to reconcile PLIST with what's installed, taking care to preservehe1-3/+5
the PLIST.x86* entries. The sse2 entries are however gone, but a few new ones have appeared (md4_x86_32.h etc.) Installs cleanly now on NetBSD/i386 6.1.5.
2016-06-06bin/freshclam also needs paxctl +mpgoyette1-2/+3
Bump revision
2016-06-06Updated py-oauthlib to 1.1.2.wiz2-8/+8
1.1.2 (2016-06-01) ------------------ * (Fix) Query strings should be able to include colons. * (Fix) Cast body to a string to ensure that we can perform a regex substitution on it.
2016-06-06Updated py-cryptography to 1.4.wiz3-9/+12
1.4 - 2016-06-04 ~~~~~~~~~~~~~~~~ * Support for OpenSSL 0.9.8 has been removed. Users on older versions of OpenSSL will need to upgrade. * Added :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`. * Added support for ``OpenSSH`` public key serialization. * Added support for SHA-2 in RSA :class:`~cryptography.hazmat.primitives.asymmetric.padding.OAEP` when using OpenSSL 1.0.2 or greater. * Added "one shot" :meth:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey.sign` and :meth:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey.verify` methods to RSA keys.
2016-06-06Add fix for CVE-2015-8325 from upstream.taca3-11/+22
Bump PKGREVISION.
2016-06-04Update to luasec-0.6. Switch to MASTER_SITE_GITHUB.alnsn4-30/+32
Notable changes between 0.5 and 0.6: Options from OpenSSL 1.0.2f Use "any" protocol, but SSL. Merge pull request #20 from Zash/zash/checkissued Method for checking if one certificate issued another Merge pull request #68 from ignacio/master Enables building with LuaRocks and MS compilers Enables building with LuaRocks and MS compilers Merge pull request #56 from gleydsonsoares/Makefile-tweaks Makefile tweaks Keep 'sslv23' for compability, but deprected. (it will be removed in the next version) Merge pull request #62 from gleydsonsoares/update_protocol_samples add TLS_method / rename "sslv23" to "any" / update protocol samples. update protocol samples(bring "tlsv1_2" to clients and "any" to servers) for consistency and readability, rename "sslv23" to "any" since that it is related to {TLS, SSLv23}methods that handles all supported protocols. add TLS_method(). for now, keep SSLv23_method() for compatibility. Update samples (using 'tlsv1'). Merge pull request #55 from gleydsonsoares/ifndef-OPENSSL_NO_SSL3 guard SSLv3_method() with #ifndef OPENSSL_NO_SSL3 Add lsec_testcontext(). bump MACOSX_VERSION fix typo; s,intall,install, guard SSLv3_method() with #ifndef OPENSSL_NO_SSL3 Set flags to compile with internal inet_ntop() by default. Tag "alpha" explicit. MinGW progress. Merge pull request #53 from hishamhm/master Reuse tag in the LuaSec upstream repository. Merge pull request #26 from Tieske/master Update rockspec to fix Windows build Alternative implementation to inet_ntop() for old versions of Windows. Do not hardcode ar added batch files to generate sample certs on Windows Perform all validation before allocating structures Validate signatures too. API changes to root:issued([intermediate]*, cert) Fix inet_ntop() on Windows. Merge branch 'master' of https://github.com/brunoos/luasec Merge branch 'moteus_rock' added bindir to lib section, as mingw links against dll's to be found in bindir updated defines in rockspec Merge branch 'master' of github.com:Tieske/luasec into moteus_rock use winsock 2 Don't set globals from C. Fix unpack(). Stop using module(). Change to luaL_newlib(). Remove luaL_optint() and luaL_checkint(). BSD headers. Merge pull request #21 from Zash/zash/iPAddress-fix iPAddress encoding Stop if we don't have a string. Changed for strict compiles. Fix for LibreSSL/OPENSSL_NO_COMP Problem on Win64, since double does not represent SOCKET_INVALID exactly. - Add a parameter to server:sni(), so that we can accept an unknown name, using the initial context. - Add the method :getsniname() to retrieve the SNI hostname used. Updated (and renamed) rockspec Windows Encode iPAddress fields in human readable form Don't try to encode IP addresses as UTF-8 Return early if ASN1 string is invalid Push nil if unable to encode ASN1 string as UTF-8 Return human readable error message from cert:issued() SNI support. SNI support. Merge pull request #17 from Zash/zash/checkkey Verify that certificate and key belong together Merge pull request #19 from Zash/zash/pubkey Zash/pubkey Add cert:pubkey() to methods registry Add cert:issued(leafcert) for checking chains Check if private key matches cert only if both key and cert are set Check that certificate matches private key Add method for extracting public key, type and size from x509 objects
2016-06-03Update to 5.32. Changelog:jym4-17/+19
Version 5.32, 2016.05.03, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 1.0.2h. https://www.openssl.org/news/secadv_20160503.txt * New features - New "socket = a:IPV6_V6ONLY=yes" option to only bind IPv6. - Memory leak detection. - Improved compatibility with the current OpenSSL 1.1.0-dev tree. - Added/fixed Red Hat scripts (thx to Andrew Colin Kissa). * Bugfixes - Workaround for a WinCE sockets quirk (thx to Richard Kraemer). - Fixed data alignment on 64-bit MSVC (thx to Yuris W. Auzins).
2016-06-03Update pgpdump to 0.31.bsiegert2-7/+7
0.31 2016/05/09 * Fixing a buffer overrun. 0.30 2016/04/13 * Security fix: https://github.com/kazu-yamamoto/pgpdump/pull/16
2016-06-03Avoid dependency on /usr/ucb on SunOS, fixes install on at leastfhajny3-16/+33
SmartOS. Sort PLIST with LANG=C.
2016-06-03Update security/py-certbot to 0.8.0.fhajny3-14/+16
Changes in 0.8.0 - The main new feature in this release is the register subcommand which can be used to register an account with the Let's Encrypt CA. Additionally, you can run certbot register --update-registration to change the e-mail address associated with your registration. Full commit log since 0.7.0: https://github.com/certbot/certbot/compare/v0.7.0...v0.8.0 Changes in 0.7.0: - --must-staple to request certificates from Let's Encrypt with the OCSP must staple extension - automatic configuration of OSCP stapling for Apache - requesting certificates for domains found in the common name of a custom CSR - a number of bug fixes Full commit log since 0.6.0 https://github.com/certbot/certbot/compare/v0.6.0...v0.7.0
2016-06-03Update netpgpverify to 20160313agc2-2/+3
+ minor cosmetic change to bn.h to also define BN_mod_sub, missed in previous
2016-06-02Explicitly disable extended glob(3C) support on SunOS, despite itjperkin1-1/+5
being available on newer illumos, as it simplifies PLIST.glob.
2016-06-02Make perl a runtime dependency, it is used by c_rehash. Reported byjperkin1-5/+5
Jorge Schrauwen in joyent/pkgsrc#354. Bump PKGREVISION.
2016-06-01Tell configure where to look for Botan.joerg1-2/+2
2016-06-01Fix MASTER_SITES.wiz3-6/+6
2016-05-31Use library pattern on the BSDs as well.joerg5-1/+61
2016-05-31Deal with lack of TR1 support in libc++ by using the C++11 directlyjoerg7-1/+143
then.
2016-05-30Seems that clamd needs to disable mprotect. Bump pkg revision.pgoyette1-2/+4
2016-05-26Update security/py-yara to version 3.4.0khorben1-5/+5
The changes include: * Short-circuit evaluation for conditions * New yr_rules_save_stream/yr_rules_load_stream APIs. * load() and save() methods in yara-python accept file-like objects * Improvements to the PE and ELF modules * Some performance improvements * New command-line option --print-module-data * Multiple bug fixes.
2016-05-26Update security/yara to version 3.4.0khorben3-8/+9
The changes include: * Short-circuit evaluation for conditions * New yr_rules_save_stream/yr_rules_load_stream APIs. * load() and save() methods in yara-python accept file-like objects * Improvements to the PE and ELF modules * Some performance improvements * New command-line option --print-module-data * Multiple bug fixes.
2016-05-26Switch to ImageMagick6 to fix build. Bump PKGREVISION.wiz1-3/+3
2016-05-26Add kf5 packagesmarkd1-1/+4
2016-05-26Add KDE Frameworks 5.21.0 packages:markd16-0/+496
kauth - Abstraction to system policy and authentication features kdesu - Integration with su for elevated privileges kwallet - Secure and unified container for user passwords
2016-05-26Add gpgmeppmarkd1-1/+2
2016-05-26Add gpgmepp 15.12.2markd5-0/+110
GpgME++ is a C++ wrapper (or C++ bindings) for the GnuPG project's gpgme (GnuPG Made Easy) library, version 0.4.4 and later. It is fairly complete, with some minor things still missing (in particular, the key edit interface). It is mostly tested using external event loops, for which its design is optimised.
2016-05-26Add polkit-qt5markd1-1/+2
2016-05-26Add polkit-qt5 0.112.0markd5-0/+95
Polkit-Qt is a library that lets developers use the Polkit API through a nice Qt-styled API. It is mainly a wrapper around QAction and QAbstractButton that lets you integrate those two component easily with Polkit. This package provides Qt5 libraries.
2016-05-25Enable hitchfhajny1-1/+2
2016-05-25Import hitch-1.2.0 as security/hitch (based on wip/hitch).fhajny9-0/+196
Hitch is a libev-based high performance SSL/TLS proxy by Varnish Software.
2016-05-25Enable py-certbot and py-acmefhajny1-1/+3
2016-05-25Import certbot 0.6.0 as security/py-certbot.fhajny9-0/+513
Certbot, previously the Let's Encrypt Client, is EFF's tool to obtain certs from Let's Encrypt, and (optionally) autoenable HTTPS on your server. It can also act as a client for any other CA that uses the ACME protocol.
2016-05-23Update MASTER_SITES to match current layout at the master site.kre1-2/+2
OK wiz@
2016-05-21+ mate-polkityouri1-1/+2
2016-05-21Remove commented lang/spidermonkey/bl3 line.leot1-2/+1
Actually polkit needs spidermokey17 (but also supports the - older - spidermonkey185, but not spidermonkey-1.8.0rc1).
2016-05-21Import mate-polkit-1.14.0 as security/mate-polkit.youri6-0/+154
PolicyKit-mate provides an Authentication Agent for PolicyKit that integrates well with the MATE desktop environment See http://www.freedesktop.org/wiki/Software/PolicyKit for lots of documentation, mailing lists, etc. about PolicyKit. See also the file HACKING for notes of interest to developers working on PolicyKit-mate. Report bugs against PolicyKit-mate at github https://github.com/mate-desktop/mate-polkit/issues MATE polkit is a fork of GNOME polkit.
2016-05-21post-extract chmod no longer necessaryrichard1-4/+1
2016-05-20Update include for pkgsrc.youri2-4/+4
2016-05-20+ polkityouri1-1/+2
2016-05-20Import polkit-0.113nb1 as security/polkit.youri15-0/+730
PolicyKit is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to speak to privileged processes.
2016-05-19Bump revisions for Botan update.joerg1-2/+2
2016-05-19Update Botan to 1.10.12, the latest pre-C++11 version.joerg35-978/+356
Includes various security fixes.
2016-05-19Update to Botan 1.11.29:joerg9-139/+69
- CVE-2016-2849: side channel attack against DSA and ECDSA - CVE-2016-2850: failure to enforce TLS policies could lead to weaker algorithms being choosen - CVE-2016-2195: heap overflow in ECC point decoding - CVE-2016-2196: heap overflow in P-521 reduction - CVE-2016-2194: DOS against the modular reduction - CVE-2015-7824: padding oracle attack against TLS CBC - CVE-2015-7825: DOS due to certificate chains - CVE-2015-7826: wildcard certifications verification failures - CVE-2015-7827: protection against PKCS#1 side channel issues - CVE-2015-5726: potential DOS with invalid zero-length BER - CVE-2015-5727: unbound memory use with BER - deprecation or removal of various insecure crypto primitives - TLS heartbeat removed - various other bugfixes and improvements.
2016-05-18Pass CFLAGS and LDFLAGS to imake. Fixes MKPIE build.alnsn1-1/+4
2016-05-18Undo previous, contaminated testing environment, py-cryptography isn'the1-2/+1
needed after all.
2016-05-18Add missing dependency on py-cryptography. Without this, usage failshe1-1/+2
with "ImportError: No module named cryptography.hazmat.backends" from paramiko/transport.py.
2016-05-17Use REAL_ROOT_USER/REAL_ROOT_GROUP instead of ROOT_USER/ROOT_GROUPfhajny4-17/+17
for all pkgsrc dir/file ownership rules. Fixes unprivileged user/group names from leaking into binary packages, manifest as non-fatal chown/chgrp failure messages at pkg_add time. Bump respective packages' PKGREVISION.
2016-05-15Fix netbsd-6 buildryoon1-1/+2
Patch from nonaka@, thank you.
2016-05-14Fix _gcry_sha1_transform_amd64_avx undefined reference errorryoon1-1/+8
under NetBSD/amd64 6 and CentOS 6. * Explicitly disable AVX and AVX2 for GCC 4.4 and 4.5
2016-05-12Updated py-cryptography to 1.3.2.wiz2-8/+8
1.3.2 - 2016-05-04 ~~~~~~~~~~~~~~~~~~ * Updated Windows and OS X wheels to be compiled against OpenSSL 1.0.2h. * Fixed an issue preventing ``cryptography`` from compiling against LibreSSL 2.3.x.
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-28 01:06:40 +0000