summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2014-08-07Update openssl to 1.0.1i.obache3-7/+8
Changes between 1.0.1h and 1.0.1i [6 Aug 2014] *) Fix SRP buffer overrun vulnerability. Invalid parameters passed to the SRP code can be overrun an internal buffer. Add sanity check that g, A, B < N to SRP code. Thanks to Sean Devlin and Watson Ladd of Cryptography Services, NCC Group for discovering this issue. (CVE-2014-3512) [Steve Henson] *) A flaw in the OpenSSL SSL/TLS server code causes the server to negotiate TLS 1.0 instead of higher protocol versions when the ClientHello message is badly fragmented. This allows a man-in-the-middle attacker to force a downgrade to TLS 1.0 even if both the server and the client support a higher protocol version, by modifying the client's TLS records. Thanks to David Benjamin and Adam Langley (Google) for discovering and researching this issue. (CVE-2014-3511) [David Benjamin] *) OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject to a denial of service attack. A malicious server can crash the client with a null pointer dereference (read) by specifying an anonymous (EC)DH ciphersuite and sending carefully crafted handshake messages. Thanks to Felix Gröbert (Google) for discovering and researching this issue. (CVE-2014-3510) [Emilia Käsper] *) By sending carefully crafted DTLS packets an attacker could cause openssl to leak memory. This can be exploited through a Denial of Service attack. Thanks to Adam Langley for discovering and researching this issue. (CVE-2014-3507) [Adam Langley] *) An attacker can force openssl to consume large amounts of memory whilst processing DTLS handshake messages. This can be exploited through a Denial of Service attack. Thanks to Adam Langley for discovering and researching this issue. (CVE-2014-3506) [Adam Langley] *) An attacker can force an error condition which causes openssl to crash whilst processing DTLS packets due to memory being freed twice. This can be exploited through a Denial of Service attack. Thanks to Adam Langley and Wan-Teh Chang for discovering and researching this issue. (CVE-2014-3505) [Adam Langley] *) If a multithreaded client connects to a malicious server using a resumed session and the server sends an ec point format extension it could write up to 255 bytes to freed memory. Thanks to Gabor Tyukasz (LogMeIn Inc) for discovering and researching this issue. (CVE-2014-3509) [Gabor Tyukasz] *) A malicious server can crash an OpenSSL client with a null pointer dereference (read) by specifying an SRP ciphersuite even though it was not properly negotiated with the client. This can be exploited through a Denial of Service attack. Thanks to Joonas Kuorilehto and Riku Hietamäki (Codenomicon) for discovering and researching this issue. (CVE-2014-5139) [Steve Henson] *) A flaw in OBJ_obj2txt may cause pretty printing functions such as X509_name_oneline, X509_name_print_ex et al. to leak some information from the stack. Applications may be affected if they echo pretty printing output to the attacker. Thanks to Ivan Fratric (Google) for discovering this issue. (CVE-2014-3508) [Emilia Käsper, and Steve Henson] *) Fix ec_GFp_simple_points_make_affine (thus, EC_POINTs_mul etc.) for corner cases. (Certain input points at infinity could lead to bogus results, with non-infinity inputs mapped to infinity too.) [Bodo Moeller]
2014-08-06netbsd-desktop@ is a retired list.obache2-4/+4
2014-08-06pev 0.60 was re-released with changes to the original archivekhorben1-4/+4
2014-08-05Update to 4.0:wiz2-6/+6
--- 4.0 --- * Removed ``keyring_path`` parameter from ``load_keyring``. See release notes for 3.0.3 for more details. * Issue #22: Removed support for loading the config from the current directory. The config file must now be located in the platform-specific config location.
2014-08-02Added security/pevkhorben1-1/+2
2014-08-02Imported security/pev version 0.60 from wipkhorben6-0/+103
pev is a PE file analysis toolkit that includes some nice programs to work with PE files in many systems. It can be useful for programmers, security analysts and forensic investigators. It's licensed under GPLv3+ terms.
2014-07-30Add runtime dependency on flex (in bin/compile_et). Bump PKGREVISION.fhajny1-3/+3
2014-07-29Update to 0.5.2:wiz3-7/+64
0.5.2 - 2014-07-09 ~~~~~~~~~~~~~~~~~~ * Add :class:`~cryptography.hazmat.backends.interfaces.TraditionalOpenSSLSerializationBackend` support to :doc:`/hazmat/backends/multibackend`. * Fix compilation error on OS X 10.8 (Mountain Lion). 0.5.1 - 2014-07-07 ~~~~~~~~~~~~~~~~~~ * Add :class:`~cryptography.hazmat.backends.interfaces.PKCS8SerializationBackend` support to :doc:`/hazmat/backends/multibackend`. 0.5 - 2014-07-07 ~~~~~~~~~~~~~~~~ * **BACKWARDS INCOMPATIBLE:** :class:`~cryptography.hazmat.primitives.ciphers.modes.GCM` no longer allows truncation of tags by default. Previous versions of ``cryptography`` allowed tags to be truncated by default, applications wishing to preserve this behavior (not recommended) can pass the ``min_tag_length`` argument. * Windows builds now statically link OpenSSL by default. When installing a wheel on Windows you no longer need to install OpenSSL separately. Windows users can switch between static and dynamic linking with an environment variable. See :doc:`/installation` for more details. * Added :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`. * Added :class:`~cryptography.hazmat.primitives.ciphers.modes.CFB8` support for :class:`~cryptography.hazmat.primitives.ciphers.algorithms.AES` and :class:`~cryptography.hazmat.primitives.ciphers.algorithms.TripleDES` on :doc:`/hazmat/backends/commoncrypto` and :doc:`/hazmat/backends/openssl`. * Added ``AES`` :class:`~cryptography.hazmat.primitives.ciphers.modes.CTR` support to the OpenSSL backend when linked against 0.9.8. * Added :class:`~cryptography.hazmat.backends.interfaces.PKCS8SerializationBackend` and :class:`~cryptography.hazmat.backends.interfaces.TraditionalOpenSSLSerializationBackend` support to the :doc:`/hazmat/backends/openssl`. * Added :doc:`/hazmat/primitives/asymmetric/ec` and :class:`~cryptography.hazmat.backends.interfaces.EllipticCurveBackend`. * Added :class:`~cryptography.hazmat.primitives.ciphers.modes.ECB` support for :class:`~cryptography.hazmat.primitives.ciphers.algorithms.TripleDES` on :doc:`/hazmat/backends/commoncrypto` and :doc:`/hazmat/backends/openssl`. * Deprecated :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey` in favor of backend specific providers of the :class:`~cryptography.hazmat.primitives.interfaces.RSAPrivateKey` interface. * Deprecated :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey` in favor of backend specific providers of the :class:`~cryptography.hazmat.primitives.interfaces.RSAPublicKey` interface. * Deprecated :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey` in favor of backend specific providers of the :class:`~cryptography.hazmat.primitives.interfaces.DSAPrivateKey` interface. * Deprecated :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKey` in favor of backend specific providers of the :class:`~cryptography.hazmat.primitives.interfaces.DSAPublicKey` interface. * Deprecated :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAParameters` in favor of backend specific providers of the :class:`~cryptography.hazmat.primitives.interfaces.DSAParameters` interface. * Deprecated ``encrypt_rsa``, ``decrypt_rsa``, ``create_rsa_signature_ctx`` and ``create_rsa_verification_ctx`` on :class:`~cryptography.hazmat.backends.interfaces.RSABackend`. * Deprecated ``create_dsa_signature_ctx`` and ``create_dsa_verification_ctx`` on :class:`~cryptography.hazmat.backends.interfaces.DSABackend`.
2014-07-28Darwin doesn't build sudo_noexec.so, patch from Sevan Janiyan.jperkin2-4/+10
2014-07-28This package is still useful on SunOS, as it provides more functionalityfhajny3-7/+11
compared to the one shipped with the platform. Enable for SunOS, but disable the INSTALL/DEINSTALL symlinks. Bump PKGREVISION.
2014-07-28Fix overlooked option name for previous.wiz2-3/+4
Found by jperkin.
2014-07-27Improve default options for SSHGuard. "-f 100:/var/run/sshd.pid" intron2-4/+7
particular affects the detection rate badly. Bump package revision.
2014-07-26Add and enable "sshguard" package.tron1-1/+2
2014-07-26Add new "sshguard" package:tron7-0/+198
Sshguard is a small program that monitors services running on your machine from the log files. When it detects that someone is doing something bad to a service, sshguard blocks the IP address of the bad guy with a firewall rule. Sshguard was started in 2006 to mitigate the growing brute force attacks to SSH servers. Because of the generality of its infrastructure, however, it was soon extended to monitor and protect more and more services.
2014-07-25Don't override LDFLAGS, fixes check-shlibs.jperkin2-1/+17
2014-07-24Make sure RPATH to libcrypto is added, fixes check-shlibs-elf.jperkin1-2/+6
2014-07-23Update security/p5-String-Random to 0.26.hiramatsu2-7/+7
Changes from previous: ---------------------- 0.26 Fri Jan 31 2014 - LICENSE section and file (CPANTS). - Minimum version of perl in Build.PL / META.yml . 0.25 Fri Dec 27 2013 - Update the link to the version control repository. 0.24 Tue Dec 03 2013 - Add keywords and a link to he repository to Build.PL / META.yml. 0.23 Tue Dec 03 2013 - Add t/style-trailing-space.t . - Update the POD in lib/String/Random.pm . - Add t/pod.t . - Convert Build.PL to Test::Run::Builder. - Hopefully fix https://rt.cpan.org/Public/Bug/Display.html?id=86894 - Bug #86894 for String-Random: Spurious warnings
2014-07-22Update to 2.0.25. Rename gpgsm option to gnupg2-gpgsm.wiz3-9/+12
Noteworthy changes in version 2.0.25 (2014-06-30) ------------------------------------------------- * gpg: Fix a regression in 2.0.24 if more than one keyid is given to --recv-keys et al. * gpg: Cap RSA and Elgamal keysize at 4096 bit also for unattended key generation. * gpgsm: Fix a DISPLAY related problem with --export-secret-key-p12. * scdaemon: Support reader Gemalto IDBridge CT30.
2014-07-22Update to 1.4.18:wiz2-6/+6
Noteworthy changes in version 1.4.18 (2014-06-30) ------------------------------------------------- * Fix a regression in 1.4.17 if more than one keyid is given to --recv-keys et al. * Cap RSA and Elgamal keysize at 4096 bit also for unattended key generation.
2014-07-22Update to 1.1.8.wiz2-7/+6
New keyart binary (not installed) documenation improvements.
2014-07-22Bug fix from upstream so that SAML assertion are correctly readen.manu3-5/+26
2014-07-20Update to 1.4.3:schnoebe3-11/+80
Changelog: Version 1.4.3 - November 27 2012 libssh2 1.4.3 GPG sig (685712 bytes) Changes: compression: add support for zlib@openssh.com Bug fixes: sftp_read: return error if a too large package arrives libssh2_hostkey_hash.3: update the description of return value Fixed MSVC NMakefile examples: use stderr for messages, stdout for data openssl: do not leak memory when handling errors improved handling of disabled MD5 algorithm in OpenSSL known_hosts: Fail when parsing unknown keys in known_hosts file configure: gcrypt doesn't come with pkg-config support session_free: wrong variable used for keeping state libssh2_userauth_publickey_fromfile_ex.3: mention publickey == NULL comp_method_zlib_decomp: handle Z_BUF_ERROR when inflating Version 1.4.2 - May 18 2012 libssh2 1.4.2 GPG sig (679992 bytes) Bug fixes: Return LIBSSH2_ERROR_SOCKET_DISCONNECT on EOF when reading banner userauth.c: fread() from public key file to correctly detect any errors configure.ac: Add option to disable build of the example applications Added 'Requires.private:' line to libssh2.pc SFTP: filter off incoming "zombie" responses gettimeofday: no need for a replacement under cygwin SSH_MSG_CHANNEL_REQUEST: default to want_reply win32/libssh2_config.h: Remove hardcoded #define LIBSSH2_HAVE_ZLIB Version 1.4.1 - April 4 2012 libssh2 1.4.1 GPG sig (658507 bytes) Bug fixes: build error with gcrypt backend always do "forced" window updates to avoid corner case stalls aes: the init function fails when OpenSSL has AES support transport_send: Finish in-progress key exchange before sending data channel_write: acknowledge transport errors examples/x11.c: Make sure sizeof passed to read operation is correct examples/x11.c:,Fix suspicious sizeof usage sftp_packet_add: verify the packet before accepting it SFTP: preserve the original error code more sftp_packet_read: adjust window size as necessary Use safer snprintf rather then sprintf in several places Define and use LIBSSH2_INVALID_SOCKET instead of INVALID_SOCKET sftp_write: cannot return acked data *and* EAGAIN sftp_read: avoid data *and* EAGAIN libssh2.h: Add missing prototype for libssh2_session_banner_set() Version 1.4.0 - January 31 2012 libssh2 1.4.0 GPG sig (653514 bytes) Changes: Added libssh2_session_supported_algs() Added libssh2_session_banner_get() Added libssh2_sftp_get_channel() libssh2.h: bump the default window size to 256K Bug fixes: sftp-seek: clear EOF flag userauth: Provide more informations if ssh pub key extraction fails ssh2_exec: skip error outputs for EAGAIN LIBSSH2_SFTP_PACKET_MAXLEN: increase to 80000 knownhost_check(): Don't dereference ext if NULL is passed knownhost_add: Avoid dereferencing uninitialized memory on error path OpenSSL EVP: fix threaded use of structs _libssh2_channel_read: react on errors from receive_window_adjust sftp_read: cap the read ahead maximum amount _libssh2_channel_read: fix non-blocking window adjusting Version 1.3.0 - September 6 2011 libssh2 1.3.0 GPG sig (639262 bytes) Changes: Added custom callbacks for performing low level socket I/O Bug fixes: sftp_read: advance offset correctly for buffered copies libssh2_sftp_seek64: flush packetlist and buffered data _libssh2_packet_add: adjust window size when truncating sftp_read: a short read is not end of file Version 1.2.9 - August 16 2011 libssh2 1.2.9 GPG sig (642150 bytes) Changes: Added libssh2_session_set_timeout() and libssh2_session_get_timeout() to make blocking calls get a timeout Bug fixes: configure and pkg-config: fix $VERSION s/\.NF/.nf/ to fix wrong macro name caught by man --warnings keepalive: add first basic man pages sftp_write: flush the packetlist on error sftp_write: clean offsets on error msvcproj: added libs and debug stuff SCP: fix incorrect error code session_startup: init state properly sftp_write_sliding: send the complete file userauth_keyboard_interactive: skip code on zero length auth _libssh2_wait_socket: fix timeouts for poll() uses agent_list_identities: fix out of scope access _libssh2_recv(): handle ENOENT error as EAGAIN userauth_keyboard_interactive: fix buffer overflow removed man pages for non-existing functions! gettimeofday: fix name space pollution _libssh2_channel_write: handle window_size == 0 better Version 1.2.8 - April 5 2011 libssh2 1.2.8 GPG sig (637707 bytes) Changes: added libssh2_free, libssh2_channel_get_exit_signal and libssh2_session_handshake SFTP read/write remade and now MUCH faster, especially on high latency connections added new examples: ssh2_echo.c, sftp_append.c and sftp_write_sliding.c userauth: derive publickey from private NEWS: now generated from git Bug fixes: Support unlimited number of host names in a single line of the known_hosts file. fix memory leak in userauth_keyboard_interactive() fix memory leaks (two times cipher_data) for each sftp session session_startup: manage server data before server identification SCP: allow file names with bytes > 126 scp_recv: improved treatment of channel_read() returning zero libssh2_userauth_authenticated: make it work as documented variable size cleanup: match internal variable sizes better with the sizes of the fields used on the wire channel_request_pty_size: fix reqPTY_state sftp_symlink: return error if receive buffer too small sftp_readdir: return error if buffer is too small libssh2_knownhost_readfile.3: clarify return value configure: stop using the deprecated AM_INIT_AUTOMAKE syntax Fixed Win32 makefile which was now broken at resource build kex_agree_hostkey: fix NULL pointer derefence _libssh2_ntohu64: fix conversion from network bytes to uint64 ssize_t: proper typedef with MSVC compilers zlib: Add debug tracing of zlib errors decomp: increase decompression buffer sizes Version 1.2.7 - August 17 2010 libssh2 1.2.7 GPG sig (583105 bytes) Changes: Added Watcom makefile Bug fixes: Better handling of invalid key files inputchecks: make lots of API functions check for NULL pointers libssh2_session_callback_set: extended the man page SFTP: limit write() to not produce overly large packets agent: make libssh2_agent_userauth() work blocking properly _libssh2_userauth_publickey: reject method names longer than the data channel_free: ignore problems with channel_close() typedef: make ssize_t get typedef without LIBSSH2_WIN32 _libssh2_wait_socket: poll needs milliseconds libssh2_wait_socket: reset error code to "leak" EAGAIN less Added include for sys/select.h to get fd.set on some platforms session_free: free more data to avoid memory leaks openssl: make use of the EVP interface Fix underscore typo for 64-bit printf format specifiers on Windows Make libssh2_debug() create a correctly terminated string userauth_hostbased_fromfile: packet length too short handshake: Compression enabled at the wrong time Don't overflow MD5 server hostkey Version 1.2.6 - June 10 2010 libssh2 1.2.6 GPG sig (579590 bytes) Changes: Added libssh2_sftp_statvfs() and libssh2_sftp_fstatvfs() Added libssh2_knownhost_checkp() Added libssh2_scp_send64() Bug fixes: wait_socket: make c89 compliant and use two fd_sets for select() OpenSSL AES-128-CTR detection proper keyboard-interactive user dialog in the sftp.c example build procedure for VMS fixed libssh2.dsw to use the generated libssh2.dsp several Windows-related build fixes fail to init SFTP if session isn't already authenticated many tiny fixes that address clang-analyzer warnings sftp_open: deal with short channel_write calls libssh2_publickey_init: fixed to work better non-blocking sftp_close_handle: add precation to not access NULL pointer sftp_readdir: simplified and bugfixed channel_write: if data has been sent, don't return EAGAIN Version 1.2.5 - April 13 2010 libssh2 1.2.5 GPG sig (559553 bytes) Changes: Added Add keep-alive support: libssh2_keepalive_config() and libssh2_keepalive_send() Added libssh2_knownhost_addc(), libssh2_init() and libssh2_exit() Added LIBSSH2_SFTP_S_IS***() macros Bug fixes: fix memory leak in libssh2_session_startup() added missing error codes - shown as hangs in blocking mode fix memory leak in userauth_keyboard_interactive() libssh2_knownhost_del: fix write to freed memory Send and receive channel EOF before sending SSH_MSG_CHANNEL_CLOSE Use AES-CTR from OpenSSL when available Fixed gettimeofday to compile with Visual C++ 6 NULL dereference when window adjusting a non-existing channel avoid using poll on interix and mac os x systems fix scp memory leak Correctly clear blocking flag after sending multipart packet Reduce used window sizes by factor 10 libssh2_userauth_publickey_fromfile_ex() handles a NULL password sftp_init() deal with _libssh2_channel_write() short returns Version 1.2.4 - February 13 2010 libssh2 1.2.4 GPG sig (547675 bytes) Bug fixes: Resolve compile issues on Solaris x64 and UltraSPARC Allow compiling with OpenSSL when AES isn't available Fix Tru64 socklen_t compile issue with example/direct_tcpip.c Version 1.2.3 - February 3 2010 libssh2 1.2.3 GPG sig (547652 bytes) Changes: ssh-agent support with the new libssh2_agent_* functions Added libssh2_trace_sethandler() Added the direct_tcpip.c and ssh2_agent.c examples Bug fixes: Fixed memory leak in userauth_publickey Fixed publickey authentication regression Silenced several compiler warnings avoid returning data to memory already freed transport layer fix for bogus -39 (LIBSSH2_ERROR_BAD_USE) errors Fixed padding in ssh-dss signature blob encoding Fixed direction blocking flag problems Fixed memory leak in sftp_fstat()
2014-07-18Fix build under SCO OpenServer 5.0.7/3.2.ryoon3-2/+34
2014-07-18For SCO OpenServer 5.0.7/3.2, sco-os5 target should be used.ryoon1-1/+5
And libsocket is needed.
2014-07-18SCO OpenServer 5.0.7/3.2 does not support SSSE3.ryoon1-1/+4
2014-07-17Update to 1.9wen2-7/+6
No upstream changelog.
2014-07-17Update to 5.92wen2-7/+6
Upstream changes: 5.92 Sun Jun 1 00:15:44 MST 2014 - fixed reserved-word clash when compiling with C++ -- use 'classname' instead of 'class' -- ref. SHA.xs (rt.cpan.org #96090) - silenced MSC compiler warning about signed/unsigned comparison -- ref. SHA.xs (rt.cpan.org #95830) 5.91 Fri May 16 10:21:44 MST 2014 - restored original 'addfile' for use on opened file handles -- allows callbacks in place of actual files -- ref. IO::Callback (rt.cpan.org #95643) - re-established inheritance from Digest::base -- to pick up future Digest enhancements automatically - cleaned up documentation 5.90 Wed May 7 07:57:08 MST 2014 - consolidated all dynamic memory allocation into XSUBs -- streamlines referencing of SHA objects -- simplifies DESTROYing of objects - enhanced Makefile.PL to allow 'use warnings' -- automatically reverts to $^W for early Perls - scrubbed C and Perl code to remove all compiler warnings
2014-07-17Update to 0.22wen2-7/+6
Upstream changes: 0.22 Sun Jun 1 00:15:46 MST 2014 - fixed reserved-word clash when compiling with C++ -- use 'classname' instead of 'class' -- ref. SHA3.xs (rt.cpan.org #96090) 0.21 Fri May 16 10:21:46 MST 2014 - restored original 'addfile' for use on opened file handles -- allows callbacks in place of actual files -- ref. IO::Callback (rt.cpan.org #95643) - re-established inheritance from Digest::base -- to pick up future Digest enhancements automatically - cleaned up documentation 0.20 Wed May 7 07:57:10 MST 2014 - consolidated all dynamic memory allocation into XSUBs -- streamlines referencing of SHA3 objects -- simplifies DESTROYing of objects - enhanced Makefile.PL to allow 'use warnings' -- automatically reverts to $^W for early Perls - scrubbed C and Perl code to remove all compiler warnings
2014-07-16Caff was packaged fine, but a module was missing at run.mef1-2/+3
Add dependency +DEPENDS+= p5-Net-IDN-Encode-[0-9]*:../../textproc/p5-Net-IDN-Encode and bump PKGREVION. Thanks gdt@ for review.
2014-07-16PolarSSL ChangeLogobache2-8/+7
= Version 1.2.11 released 2014-07-11 Features * Entropy module now supports seed writing and reading Changes * Introduced POLARSSL_HAVE_READDIR_R for systems without it * Improvements to the CMake build system, contributed by Julian Ospald. * Work around a bug of the version of Clang shipped by Apple with Mavericks that prevented bignum.c from compiling. (Reported by Rafael Baptista.) * Improvements to tests/Makefile, contributed by Oden Eriksson. * Use UTC time to check certificate validity. * Reject certificates with times not in UTC, per RFC 5280. * Migrate zeroizing of data to polarssl_zeroize() instead of memset() against unwanted compiler optimizations Security * Forbid change of server certificate during renegotiation to prevent "triple handshake" attack when authentication mode is optional (the attack was already impossible when authentication is required). * Check notBefore timestamp of certificates and CRLs from the future. * Forbid sequence number wrapping * Prevent potential NULL pointer dereference in ssl_read_record() (found by TrustInSoft) * Fix length checking for AEAD ciphersuites (found by Codenomicon). It was possible to crash the server (and client) using crafted messages when a GCM suite was chosen. Bugfix * Fixed X.509 hostname comparison (with non-regular characters) * SSL now gracefully handles missing RNG * crypt_and_hash app checks MAC before final decryption * Fixed x509_crt_parse_path() bug on Windows platforms * Added missing MPI_CHK() around some statements in mpi_div_mpi() (found by TrustInSoft) * Fixed potential overflow in certificate size verification in ssl_write_certificate() (found by TrustInSoft) * Fix ASM format in bn_mul.h * Potential memory leak in bignum_selftest() * Replaced expired test certificate * ssl_mail_client now terminates lines with CRLF, instead of LF * Fix bug in RSA PKCS#1 v1.5 "reversed" operations * Fixed testing with out-of-source builds using cmake * Fixed version-major intolerance in server * Fixed CMake symlinking on out-of-source builds * Bignum's MIPS-32 assembly was used on MIPS-64, causing chaos. (Found by Alex Wilson.) * ssl_init() was leaving a dirty pointer in ssl_context if malloc of out_ctr failed * ssl_handshake_init() was leaving dirty pointers in subcontexts if malloc of one of them failed * x509_get_current_time() uses localtime_r() to prevent thread issues * Some example server programs were not sending the close_notify alert. * Potential memory leak in mpi_exp_mod() when error occurs during calculation of RR. * Improve interoperability by not writing extension length in ClientHello when no extensions are present (found by Matthew Page) * rsa_check_pubkey() now allows an E up to N * On OpenBSD, use arc4random_buf() instead of rand() to prevent warnings * mpi_fill_random() was creating numbers larger than requested on big-endian platform when size was not an integer number of limbs * Fix detection of DragonflyBSD in net.c (found by Markus Pfeiffer) * Stricter check on SSL ClientHello internal sizes compared to actual packet size (found by TrustInSoft) * Fix preprocessor checks for bn_mul PPC asm (found by Barry K. Nathan). * Use \n\t rather than semicolons for bn_mul asm, since some assemblers interpret semicolons as comment delimiters (found by Barry K. Nathan). * Disable broken Sparc64 bn_mul assembly (found by Florian Obser). * Fix base64_decode() to return and check length correctly (in case of tight buffers) = Version 1.2.10 released 2013-10-07 Changes * Changed RSA blinding to a slower but thread-safe version * Make get_pkcs_padding() constant-time Bugfix * Fixed memory leak in RSA as a result of introduction of blinding * Fixed ssl_pkcs11_decrypt() prototype * Fixed MSVC project files = Version 1.2.9 released 2013-10-01 Changes * x509_verify() now case insensitive for cn (RFC 6125 6.4) Bugfix * Fixed potential memory leak when failing to resume a session * Fixed potential file descriptor leaks (found by Remi Gacogne) * Minor fixes Security * Fixed potential heap buffer overflow on large hostname setting * Fixed potential negative value misinterpretation in load_file() * RSA blinding on CRT operations to counter timing attacks (found by Cyril Arnaud and Pierre-Alain Fouque)
2014-07-16Unbump PKGREVISION on select ruby packages.rodent3-6/+3
2014-07-16Removing .ri entries from PLIST. NFI why this works with/without therodent6-960/+9
entries on my machine. Seems no other ruby package has them. Bump PKGREVISION.
2014-07-12Update netpgpverify package to 20140712agc3-4292/+4335
+ bring the bignum implementation up to the latest version + radix conversion routines added + bitwise operations added + whitespace cleanups
2014-07-05Add dependency on p5-Term-ReadLine-Perl. Either that orwiz1-1/+3
...-Gnu is needed for kpcli to work. Bump PKGREVISION.
2014-07-04+ruby-{openid,rack-openid,ruby-openid}rodent1-1/+4
2014-07-04Import ruby200-rack-openid-1.4.2 as security/ruby-rack-openid.rodent4-0/+71
Provides a more HTTPish API around the ruby-openid library.
2014-07-04Import ruby200-ruby-openid-2.5.0 as security/ruby-ruby-openid.rodent4-0/+1071
A Ruby library for verifying and serving OpenID identities. Features: * Easy to use API for verifying OpenID identites - OpenID::Consumer * Support for serving OpenID identites - OpenID::Server * Does not depend on underlying web framework * Supports multiple storage mechanisms (Filesystem, ActiveRecord, Memory) * Example code to help you get started, including: * Ruby on Rails based consumer and server * OpenIDLoginGenerator for quickly getting creating a rails app that uses OpenID for authentication * ActiveRecordOpenIDStore plugin * Comprehensive test suite * Supports both OpenID 1 and OpenID 2 transparently
2014-07-04Import ruby200-openid-0.0.1 as security/ruby-openid.rodent4-0/+121
OpenID support for Ruby. OpenID is a decentralized identification system that allows users to prove they own a url. OpenID for Ruby currently includes only consumer modules.
2014-07-03Add SMF manifest for stud.jperkin1-0/+29
2014-07-02Changes 0.98.4:adam2-6/+6
- Various build problems on Solaris, OpenBSD, AIX. - Crashes of clamd on Windows and Mac OS X platforms when reloading&nbsp;the virus signature database. - Infinite loop in clamdscan when clamd is not running. - Freshclam failure on Solaris 10. - Buffer underruns when handling multi-part MIME email attachments. - Configuration of OpenSSL on various platforms. - Name collisions on Ubuntu 14.04, Debian sid, and Slackware 14.1. - Linking issues with libclamunrar
2014-06-24Update to 2.0.24, security fix:wiz2-8/+6
Noteworthy changes in version 2.0.24 (2014-06-24) ------------------------------------------------- * gpg: Avoid DoS due to garbled compressed data packets. * gpg: Screen keyserver responses to avoid importing unwanted keys from rogue servers. * gpg: The validity of user ids is now shown by default. To revert this add "list-options no-show-uid-validity" to gpg.conf. * gpg: Print more specific reason codes with the INV_RECP status. * gpg: Allow loading of a cert only key to an OpenPGP card. * gpg-agent: Make ssh support for ECDSA keys work with Libgcrypt 1.6. Noteworthy changes in version 2.0.23 (2014-06-03) ------------------------------------------------- * gpg: Reject signatures made using the MD5 hash algorithm unless the new option --allow-weak-digest-algos or --pgp2 are given. * gpg: Do not create a trustdb file if --trust-model=always is used. * gpg: Only the major version number is by default included in the armored output. * gpg: Print a warning if the Gnome-Keyring-Daemon intercepts the communication with the gpg-agent. * gpg: The format of the fallback key listing ("gpg KEYFILE") is now more aligned to the regular key listing ("gpg -k"). * gpg: The option--show-session-key prints its output now before the decryption of the bulk message starts. * gpg: New %U expando for the photo viewer. * gpgsm: Improved handling of re-issued CA certificates. * scdaemon: Various fixes for pinpad equipped card readers. * Minor bug fixes.
2014-06-24Update to 1.4.17 due to security fix:wiz3-9/+7
Noteworthy changes in version 1.4.17 (2014-06-23) ------------------------------------------------- * Avoid DoS due to garbled compressed data packets. * Screen keyserver reponses to avoid import of unwanted keys by rogue servers. * Add hash algorithms to the "sig" records of the colon output. * More specific reason codes for INV_RECP status. * Fixes for PC/SC access on Apple. * Minor bug fixes.
2014-06-19Fix list overrun that causes a crashmanu3-3/+22
Submitted upstream as https://sourceforge.net/p/ssldump/patches/9/
2014-06-17fix SMF Manifest installation by not overwriting INSTALLATION_DIRSwiedi1-2/+2
2014-06-14fix SMF Manifest installation by not overwriting INSTALLATION_DIRSwiedi1-2/+2
2014-06-14Update to 2.7:wiz2-6/+6
2014-Jun-11 v2.7 - Bug fix release. Broke the open command in 2.6.
2014-06-12needs openssl as suggested by bulk buildwiedi1-1/+2
2014-06-12needs openssl as suggested by bulk buildwiedi1-1/+2
2014-06-12Update security/py-paramiko to 1.14.0gls3-10/+10
Upstream changes: ----------------- :release:`1.14.0 <2014-05-07>` ------------------------------ :bug:`-` paramiko.file.BufferedFile.read incorrectly returned text strings after the Python 3 migration, despite bytes being more appropriate for file contents (which may be binary or of an unknown encoding.) This has been addressed. Note paramiko.file.BufferedFile.readline continues to return strings, not bytes, as "lines" only make sense for textual data. It assumes UTF-8 by default. This should fix this issue raised on the Obnam mailing list. Thanks to Antoine Brenner for the patch. :bug:`-` Added self.args for exception classes. Used for unpickling. Related to (Fabric #986, Fabric #714). Thanks to Alex Plugaru. :bug:`-` Fix logging error in sftp_client for filenames containing the '%' character. Thanks to Antoine Brenner. :bug:`308` Fix regression in dsskey.py that caused sporadic signature verification failures. Thanks to Chris Rose. :support:`299` Use deterministic signatures for ECDSA keys for improved security. Thanks to Alex Gaynor. :support:`297` Replace PyCrypto's Random with os.urandom for improved speed and security. Thanks again to Alex. :support:`295` Swap out a bunch of PyCrypto hash functions with use of hashlib. Thanks to Alex Gaynor. :support:`290` (also :issue:`292`) Add support for building universal (Python 2+3 compatible) wheel files during the release process. Courtesy of Alex Gaynor. :support:`284` Add Python language trove identifiers to setup.py. Thanks to Alex Gaynor for catch & patch. :bug:`235` Improve string type testing in a handful of spots (e.g. s/if type(x) is str/if isinstance(x, basestring)/g.) Thanks to @ksamuel for the report. :release:`1.13.0 <2014-03-13>` ------------------------------ :feature:`16` Python 3 support! Our test suite passes under Python 3, and it (& Fabric's test suite) continues to pass under Python 2. Python 2.5 is no longer supported with this change! The merged code was built on many contributors' efforts, both code & feedback. In no particular order, we thank Daniel Goertzen, Ivan Kolodyazhny, Tomi Pieviläinen, Jason R. Coombs, Jan N. Schulze, @Lazik, Dorian Pula, Scott Maxwell, Tshepang Lekhonkhobe, Aaron Meurer, and Dave Halter. :support:`256 backported` Convert API documentation to Sphinx, yielding a new API docs website to replace the old Epydoc one. Thanks to Olle Lundberg for the initial conversion work. :bug:`-` Use constant-time hash comparison operations where possible, to protect against timing-based attacks. Thanks to Alex Gaynor for the patch. :release:`1.12.2 <2014-02-14>` ------------------------------ :feature:`58` Allow client code to access the stored SSH server banner via Transport.get_banner <paramiko.transport.Transport.get_banner>. Thanks to @Jhoanor for the patch. :bug:`252` (Fabric #1020) Enhanced the implementation of ProxyCommand to avoid a deadlock/hang condition that frequently occurs at Transport shutdown time. Thanks to Mateusz Kobos, Matthijs van der Vleuten and Guillaume Zitta for the original reports and to Marius Gedminas for helping test nontrivial use cases. :bug:`268` Fix some missed renames of ProxyCommand related error classes. Thanks to Marius Gedminas for catch & patch. :bug:`34` (PR :issue:`35`) Fix SFTP prefetching incompatibility with some SFTP servers regarding request/response ordering. Thanks to Richard Kettlewell. :bug:`193` (and its attentant PRs :issue:`230` & :issue:`253`) Fix SSH agent problems present on Windows. Thanks to David Hobbs for initial report and to Aarni Koskela & Olle Lundberg for the patches. :release:`1.12.1 <2014-01-08>` ------------------------------ :bug:`225 (1.12+)` Note ecdsa requirement in README. Thanks to Amaury Rodriguez for the catch. :bug:`176` Fix AttributeError bugs in known_hosts file (re)loading. Thanks to Nathan Scowcroft for the patch & Martin Blumenstingl for the initial test case.
2014-06-12Update security/py-ecdsa to 0.11gls2-8/+7
Upstream changes: ----------------- * Release 0.11 (10 Mar 2014) Add signature-encoding functions "sigencode_{strings,string,der}_canonize" which canonicalize the S value (using the smaller of the two possible values). Add "validate_point=" argument to VerifyingKey.from_string() constructor (defaults to True) which can be used to disable time-consuming point validation when importing a pre-validated verifying key. Drop python2.5 support (untested but not explicitly broken yet), update trove classifiers.
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-24 23:57:38 +0000