summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2019-07-16Update to 5.55ryoon2-8/+8
* Change MASTER_SITES to https:// Changelog: Version 5.55, 2019.06.10, urgency: HIGH * Security bugfixes - Fixed a Windows local privilege escalation vulnerability caused insecure OpenSSL cross-compilation defaults. Successful exploitation requires stunnel to be deployed as a Windows service, and user-writable C:\ folder. This vulnerability was discovered and reported by Rich Mirch. - OpenSSL DLLs updated to version 1.1.1c. * Bugfixes - Implemented a workaround for Windows hangs caused by its inability to the monitor the same socket descriptor from multiple threads. - Windows configuration (including cryptographic keys) is now completely removed at uninstall. - A number of testing framework fixes and improvements. Version 5.54, 2019.05.15, urgency: LOW * New features - New "ticketKeySecret" and "ticketMacSecret" options to control confidentiality and integrity protection of the issued session tickets. These options allow for session resumption on other nodes in a cluster. - Added logging the list of active connections on SIGUSR2 or with Windows GUI. - Logging of the assigned bind address instead of the requested bind address. * Bugfixes - Service threads are terminated before OpenSSL cleanup to prevent occasional stunnel crashes at shutdown. Version 5.53, 2019.04.10, urgency: HIGH * New features - Android binary updated to support Android 4.x. * Bugfixes - Fixed data transfer stalls introduced in stunnel 5.51. Version 5.52, 2019.04.08, urgency: HIGH * Bugfixes - Fixed a transfer() loop bug introduced in stunnel 5.51.
2019-07-15botan-devel: bump buildlink dependency version.bsiegert1-3/+3
2019-07-15Update botan-devel to 2.11.0.bsiegert8-114/+135
There are too many changes to put them in this message.
2019-07-15py-certbot: updated to 0.36.0adam20-270/+274
0.36.0: Added ----- Turn off session tickets for nginx plugin by default Added missing error types from RFC8555 to acme Changed ------- Support for Ubuntu 14.04 Trusty has been removed. Update the 'manage your account' help to be more generic. The error message when Certbot's Apache plugin is unable to modify your Apache configuration has been improved. Certbot's config_changes subcommand has been deprecated and will be removed in a future release. certbot config_changes no longer accepts a --num parameter. The functions certbot.plugins.common.Installer.view_config_changes and certbot.reverter.Reverter.view_config_changes have been deprecated and will be removed in a future release. Fixed ----- Replace some unnecessary platform-specific line separation.
2019-07-14erlang-epam: fix SunOS, needs socket libswiedi1-2/+2
2019-07-12mit-krb5: Support LDAP, fix plugin shared library naming.jperkin6-22/+43
The libtool-ification caused plugins to have a "lib" prefix, causing a mismatch with what the code was trying to dlopen(), and failures. Bump PKGREVISION.
2019-07-11Update to v3.6.8sevan3-8/+11
Changes ======= * Version 3.6.8 (released 2019-05-28) ** libgnutls: Added gnutls_prf_early() function to retrieve early keying material (#329) ** libgnutls: Added support for AES-XTS cipher (#354) ** libgnutls: Fix calculation of Streebog digests (incorrect carry operation in 512 bit addition) ** libgnutls: During Diffie-Hellman operations in TLS, verify that the peer's public key is on the right subgroup (y^q=1 mod p), when q is available (under TLS 1.3 and under earlier versions when RFC7919 parameters are used). ** libgnutls: the gnutls_srp_set_server_credentials_function can now be used with the 8192 parameters as well (#995). ** libgnutls: Fixed bug preventing the use of gnutls_pubkey_verify_data2() and gnutls_pubkey_verify_hash2() with the GNUTLS_VERIFY_DISABLE_CA_SIGN flag (#754) ** libgnutls: The priority string option %ALLOW_SMALL_RECORDS was added to allow clients to communicate with the server advertising smaller limits than 512 ** libgnutls: Apply STD3 ASCII rules in gnutls_idna_map() to prevent hostname/domain crafting via IDNA conversion (#720) ** certtool: allow the digital signature key usage flag in CA certificates. Previously certtool would ignore this flag for CA certificates even if specified (#767) ** gnutls-cli/serv: added the --keymatexport and --keymatexportsize options. These allow testing the RFC5705 using these tools. ** API and ABI modifications: gnutls_prf_early: Added gnutls_record_set_max_recv_size: Added gnutls_dh_params_import_raw3: Added gnutls_ffdhe_2048_group_q: Added gnutls_ffdhe_3072_group_q: Added gnutls_ffdhe_4096_group_q: Added gnutls_ffdhe_6144_group_q: Added gnutls_ffdhe_8192_group_q: Added
2019-07-11More strnlen(3) users - from Joyentsevan1-1/+2
2019-07-11use a tabsevan1-2/+2
2019-07-10Need strnlen(3), make sure we obtain it from libnbcompat if host OS doesn'tsevan1-1/+2
include it.
2019-07-10Add include/sodium to BUILDLINK_INCDIRS.libsodium.schmonz1-1/+3
2019-07-10gnupg2: updated to 2.2.17adam2-7/+7
Noteworthy changes in version 2.2.17: * gpg: Ignore all key-signatures received from keyservers. This change is required to mitigate a DoS due to keys flooded with faked key-signatures. The old behaviour can be achieved by adding keyserver-options no-self-sigs-only,no-import-clean to your gpg.conf. * gpg: If an imported keyblocks is too large to be stored in the keybox (pubring.kbx) do not error out but fallback to an import using the options "self-sigs-only,import-clean". * gpg: New command --locate-external-key which can be used to refresh keys from the Web Key Directory or via other methods configured with --auto-key-locate. * gpg: New import option "self-sigs-only". * gpg: In --auto-key-retrieve prefer WKD over keyservers. * dirmngr: Support the "openpgpkey" subdomain feature from draft-koch-openpgp-webkey-service-07. * dirmngr: Add an exception for the "openpgpkey" subdomain to the CSRF protection. * dirmngr: Fix endless loop due to http errors 503 and 504. * dirmngr: Fix TLS bug during redirection of HKP requests. * gpgconf: Fix a race condition when killing components.
2019-07-09cyrus-sasl: Remove patch that is now actively harmful.jperkin2-15/+1
2019-07-09Use https for pythonhosted.org.nia1-2/+2
2019-07-09libtomcrypt: Update to 1.18.2nia8-230/+30
July 1st, 2018 v1.18.2 -- Fix Side Channel Based ECDSA Key Extraction (CVE-2018-12437) (PR #408) -- Fix potential stack overflow when DER flexi-decoding (CVE-2018-0739) (PR #373) -- Fix two-key 3DES (PR #390) -- Fix accelerated CTR mode (PR #359) -- Fix Fortuna PRNG (PR #363) -- Fix compilation on platforms where cc doesn't point to gcc (PR #382) -- Fix using the wrong environment variable LT instead of LIBTOOL (PR #392) -- Fix build on platforms where the compiler provides __WCHAR_MAX__ but wchar.h is not available (PR #390) -- Fix & re-factor crypt_list_all_sizes() and crypt_list_all_constants() (PR #414) -- Minor fixes (PR's #350 #351 #375 #377 #378 #379) January 22nd, 2018 v1.18.1 -- Fix wrong SHA3 blocksizes, thanks to Claus Fischer for reporting this via Mail (PR #329) -- Fix NULL-pointer dereference in `ccm_memory()` with LTC_CLEAN_STACK enabled (PR #327) -- Fix `ccm_process()` being unable to process input buffers longer than 256 bytes (PR #326) -- Fix the `register_all_{ciphers,hashes,prngs}()` return values (PR #316) -- Fix some typos, warnings and duplicate prototypes in code & doc (PR's #310 #320 #321 #335) -- Fix possible undefined behavior with LTC_PTHREAD (PR #337) -- Fix some DER bugs (PR #339) -- Fix CTR-mode when accelerator is used (OP-TEE/optee_os #2086) -- Fix installation procedure (Issue #340) October 10th, 2017 v1.18.0 -- Bugfix multi2 -- Bugfix Noekeon -- Bugfix XTEA -- Bugfix rng_get_bytes() on windows where we could read from c:\dev\random -- Fixed the Bleichbacher Signature attack in PKCS#1 v1.5 EMSA, thanks to Alex Dent -- Fixed a potential cache-based timing attack in CCM, thanks to Sebastian Verschoor -- Fix GCM counter reuse and potential timing attacks in EAX, OCB and OCBv3, thanks to Raphaël Jamet -- Implement hardened RSA operations when CRT is used -- Enabled timing resistant calculations of ECC and RSA operations per default -- Applied some patches from the OLPC project regarding PKCS#1 and preventing the hash algorithms from overflowing -- Larry Bugbee contributed the necessary stuff to more easily call libtomcrypt from a dynamic language like Python, as shown in his pyTomCrypt -- Nikos Mavrogiannopoulos contributed RSA blinding and export of RSA and DSA keys in OpenSSL/GnuTLS compatible format -- Patrick Pelletier contributed a smart volley of patches -- Christopher Brown contributed some patches and additions to ASN.1/DER -- Pascal Brand of STMicroelectronics contributed patches regarding CCM, the XTS mode and RSA private key operations with keys without CRT parameters -- RC2 now also works with smaller key-sizes -- Improved/extended several tests & demos -- Hardened DSA and RSA by testing (through Karel's perl-CryptX) against Google's "Wycheproof" and Kudelski Security's "CDF" -- Fixed all compiler warnings -- Fixed several build issues on FreeBSD, NetBSD, Linux x32 ABI, HP-UX/IA64, Mac OS X, Windows (32&64bit, Cygwin, MingW & MSVC) ... -- Re-worked all makefiles -- Re-worked most PRNG's -- The code is now verified by a linter, thanks to Francois Perrad -- Documentation (crypt.pdf) is now built deterministically, thanks to Michael Stapelberg -- Add Adler32 and CRC32 checksum algorithms -- Add Base64-URL de-/encoding and some strict variants -- Add Blake2b & Blake2s (hash & mac), thanks to Kelvin Sherlock -- Add Camellia block cipher -- Add ChaCha (stream cipher), Poly1305 (mac), ChaCha20Poly1305 (encauth) -- Add constant-time mem-compare mem_neq() -- Add DER GeneralizedTime de-/encoding -- Add DSA and ECC key generation FIPS-186-4 compliance -- Add HKDF, thanks to RyanC (especially for also providing documentation :-) ) -- Add OCBv3 -- Add PKCS#1 v1.5 mode of SSL3.0 -- Add PKCS#1 testvectors from RSA -- Add PKCS#8 & X.509 import for RSA keys -- Add stream cipher API -- Add SHA3 & SHAKE -- Add SHA512/256 and SHA512/224 -- Add Triple-DES 2-key mode, thanks to Paul Howarth -- Brought back Diffie-Hellman
2019-07-09libssh2: Update to 1.9.0nia3-8/+10
Changes: - adds ECDSA keys and host key support when using OpenSSL - adds ED25519 key and host key support when using OpenSSL 1.1.1 - adds OpenSSH style key file reading - adds AES CTR mode support when using WinCNG - adds PEM passphrase protected file support for Libgcrypt and WinCNG - adds SHA256 hostkey fingerprint - adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() - adds explicit zeroing of sensitive data in memory - adds additional bounds checks to network buffer reads - adds the ability to use the server default permissions when creating sftp directories - adds support for building with OpenSSL no engine flag - adds support for building with LibreSSL - increased sftp packet size to 256k - fixed oversized packet handling in sftp - fixed building with OpenSSL 1.1 - fixed a possible crash if sftp stat gets an unexpected response - fixed incorrect parsing of the KEX preference string value - fixed conditional RSA and AES-CTR support - fixed a small memory leak during the key exchange process - fixed a possible memory leak of the ssh banner string - fixed various small memory leaks in the backends - fixed possible out of bounds read when parsing public keys from the server - fixed possible out of bounds read when parsing invalid PEM files - no longer null terminates the scp remote exec command - now handle errors when diffie hellman key pair generation fails - fixed compiling on Windows with the flag STDCALL=ON - improved building instructions - improved unit tests
2019-07-06py-oauthlib: updated to 3.0.2adam2-7/+7
3.0.2: * Fixed space encoding in base string URI used in the signature base string. * Fixed OIDC /token response which wrongly returned "&state=None" * Doc: The value `state` must not be stored by the AS, only returned in /authorize response. * Fixed OIDC "nonce" checks: raise errors when it's mandatory
2019-07-03gpgme: updated to 1.13.1adam2-7/+7
Noteworthy changes in version 1.13.1: * cpp: gpgme_set_global_flag is now wrapped. * w32: Improved handling of unicode install paths. * w32: The gpgme_io_spawn error message is now only shown once. * Fixed a crash introduced in 1.13.0 when working with S/MIME. * w32: Fixed format string errors introduced in 1.13.0 that could cause crashes. * w32: Fixed an error in the new diagnostic gpgsm support introduced in 1.13.0 that caused crashes in low fd scenarios. * python: Fixed a DecryptionError Exception. * python: No longer raises BadSignatures from decrypt(verify=True).
2019-07-03Need to define __DARWIN_UNIX03 to use unsetenv(3) which return integer.sevan1-1/+5
Resolves build on Tiger via https://trac.macports.org/ticket/56099
2019-07-02Update to 2.4.3ryoon3-7/+39
* Add security/libsodium as dependency Changelog: 2.4.3 (2019-06-12) ========================= - Fix library loading issues in the Snap and macOS releases [#3247] - Fix various keyboard navigation issues [#3248] - Fix main window toggling regression when clicking the tray icon on KDE [#3258] - Add documentation for keyboard shortcuts to source code distribution [#3215] 2.4.2 (2019-05-31) ========================= - Improve resilience against memory attacks - overwrite memory before free [#3020] - Prevent infinite save loop when location is unavailable [#3026] - Attempt to fix quitting application when shutdown or logout issued [#3199] - Support merging database custom data [#3002] - Fix opening URL's with non-http schemes [#3153] - Fix data loss due to not reading all database attachments if duplicates exist [#3180] - Fix entry context menu disabling when using keyboard navigation [#3199] - Fix behaviors when canceling an entry edit [#3199] - Fix processing of tray icon click and doubleclick [#3112] - Update group in preview widget when focused [#3199] - Prefer DuckDuckGo service over direct icon download (increases resolution) [#2996] - Remove apply button in application settings [#3019] - Use winqtdeploy on Windows to correct deployment issues [#3025] - Don't mark entry edit as modified when attribute selection changes [#3041] - Use console code page CP_UTF8 on Windows if supported [#3050] - Snap: Fix locking database with session lock [#3046] - Snap: Fix theming across Linux distributions [#3057] - Snap: Use SNAP_USER_COMMON and SNAP_USER_DATA directories [#3131] - KeeShare: Automatically enable WITH_XC_KEESHARE_SECURE if quazip is found [#3088] - macOS: Fix toolbar text when in dark mode [#2998] - macOS: Lock database on switching user [#3097] - macOS: Fix global Auto-Type when the database is locked [#3138] - Browser: Close popups when database is locked [#3093] - Browser: Add tests [#3016] - Browser: Don't create default group if custom group is enabled [#3127]
2019-07-02Added security/py-google-auth, security/py-google-auth-httplib2, ↵adam1-1/+4
security/py-google-auth-oauthlib
2019-07-02py-google-auth-oauthlib: added version 0.4.0adam4-0/+56
This library provides oauthlib integration with google-auth.
2019-07-02py-google-auth-httplib2: added version 0.0.3adam4-0/+34
This library provides an httplib2 transport for google-auth.
2019-07-02py-google-auth: added version 1.6.3adam4-0/+138
This library simplifies using Google various server-to-server authentication mechanisms to access Google APIs
2019-07-02py-paramiko: updated to 2.6.0adam3-27/+9
2.6.0: Add a new keyword argument to SSHClient.connect and Transport, disabled_algorithms, which allows selectively disabling one or more kex/key/cipher/etc algorithms. This can be useful when disabling algorithms your target server (or client) does not support cleanly, or to work around unpatched bugs in Paramiko’s own implementation thereof. SSHClient.exec_command previously returned a naive ChannelFile object for its stdin value; such objects don’t know to properly shut down the remote end’s stdin when they .close(). This lead to issues (such as hangs) when running remote commands that read from stdin. Add backwards-compatible support for the gssapi GSSAPI library, as the previous backend (python-gssapi) has since become defunct. This change also includes tests for the GSSAPI functionality. Tweak many exception classes so their string representations are more human-friendly; this also includes incidental changes to some super() calls.
2019-07-01Redirect the last few search.cpan.org packages that I missed.nia1-3/+3
2019-07-01Follow some remaining search.cpan.org redirects.nia7-17/+17
2019-07-01Recursive revbump from boost-1.70.0ryoon20-40/+40
2019-06-30Update to 1.0.2sevan3-8/+10
Tested on OS X Tiger PowerPC and NetBSD-HEAD amd64 Changes between 1.0.2r and 1.0.2s [28 May 2019] *) Change the default RSA, DSA and DH size to 2048 bit instead of 1024. This changes the size when using the genpkey app when no size is given. It fixes an omission in earlier changes that changed all RSA, DSA and DH generation apps to use 2048 bits by default. [Kurt Roeckx] *) Add FIPS support for Android Arm 64-bit Support for Android Arm 64-bit was added to the OpenSSL FIPS Object Module in Version 2.0.10. For some reason, the corresponding target 'android64-aarch64' was missing OpenSSL 1.0.2, whence it could not be built with FIPS support on Android Arm 64-bit. This omission has been fixed. [Matthias St. Pierre] Changes between 1.0.2q and 1.0.2r [26 Feb 2019] *) 0-byte record padding oracle If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). This issue was discovered by Juraj Somorovsky, Robert Merget and Nimrod Aviram, with additional investigation by Steven Collison and Andrew Hourselt. It was reported to OpenSSL on 10th December 2018. (CVE-2019-1559) [Matt Caswell] *) Move strictness check from EVP_PKEY_asn1_new() to EVP_PKEY_asn1_add0(). [Richard Levitte] Changes between 1.0.2p and 1.0.2q [20 Nov 2018] *) Microarchitecture timing vulnerability in ECC scalar multiplication OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH, has been shown to be vulnerable to a microarchitecture timing side channel attack. An attacker with sufficient access to mount local timing attacks during ECDSA signature generation could recover the private key. This issue was reported to OpenSSL on 26th October 2018 by Alejandro Cabrera Aldaya, Billy Brumley, Sohaib ul Hassan, Cesar Pereida Garcia and Nicola Tuveri. (CVE-2018-5407) [Billy Brumley] *) Timing vulnerability in DSA signature generation The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. This issue was reported to OpenSSL on 16th October 2018 by Samuel Weiser. (CVE-2018-0734) [Paul Dale] *) Resolve a compatibility issue in EC_GROUP handling with the FIPS Object Module, accidentally introduced while backporting security fixes from the development branch and hindering the use of ECC in FIPS mode. [Nicola Tuveri]
2019-06-30Update packages using a search.cpan.org HOMEPAGE to metacpan.org.nia71-142/+142
The former now redirects to the latter. This covers the most simple cases where http://search.cpan.org/dist/name can be changed to https://metacpan.org/release/name. Reviewed by hand to hopefully make sure no unwanted changes sneak in.
2019-06-22+libb2bsiegert1-1/+2
2019-06-22Add a package for libb2-0.98.1.bsiegert6-0/+77
libb2 is a C library providing the BLAKE2b, BLAKE2s, BLAKE2bp and BLAKE2sp algorithms.
2019-06-20py-bcrypt: updated to 3.17adam2-7/+7
3.1.7: Set a setuptools lower bound for PEP517 wheel building. We no longer distribute 32-bit manylinux1 wheels. Continuing to produce them was a maintenance burden.
2019-06-19security/zoneminder: Note draft update to 1.29.0 in wipgdt1-1/+3
2019-06-18zoneminder: fix typo in comment.wiz1-2/+2
2019-06-18security/zoneminder: Update example apache config to 24gdt2-6/+10
2019-06-18security/zoneminder: Depend on p5-Net-SFTP-Foreigngdt1-2/+9
Add comment about adding dependencies on perl modules that are maybe loaded depending on the configuration.
2019-06-14tor-browser: add sun audio backend. requested by wiz.nia8-26/+829
2019-06-12py-certbot-dns-google: Python 2.7 is not supported in ↵adam1-1/+3
py-google-api-python-client
2019-06-12py-acme,py-certbot*: updated to 0.35.1adam17-79/+85
0.35.1: Fixed Support for specifying an authoritative base domain in our dns-rfc2136 plugin has been removed. This feature was added in our last release but had a bug which caused the plugin to fail so the feature has been removed until it can be added properly. Despite us having broken lockstep, we are continuing to release new versions of all Certbot components during releases for the time being, however, the only package with changes other than its version number was: certbot-dns-rfc2136
2019-06-11Import py-certbot-dns-linode py-cerbot-dns-google py-certbot-dns-gehirntriaxx1-1/+6
py-certbot-dns-dnsmadeeasy py-certbot-dns-dnsimple
2019-06-11py-cerbot-dns-dnsimple: import version 0.35.0triaxx4-0/+43
2019-06-11py-certbot-dns-dnsmakeeasy: import version 0.35.0triaxx4-0/+44
2019-06-11py-certbot-dns-gehirn: import version 0.35.0triaxx4-0/+44
2019-06-11py-certbot-dns-google: import version 0.35.0triaxx4-0/+47
2019-06-11py-certbot-dns-linode: import version 0.35.0triaxx4-0/+44
2019-06-11py-acme: update to 0.35.0triaxx22-319/+300
py-certbot: update to 0.35.0 py-certbot-apache: update to 0.35.0 py-certbot-dns-luadns: update to 0.35.0 py-certbot-dns-nsone: update to 0.35.0 py-certbot-dns-ovh: update to 0.35.0 py-certbot-dns-rfc2136: update to 0.35.0 py-certbot-dns-route53: update to 0.35.0 py-certbot-dns-sakuracloud: update to 0.35.0 py-certbot-nginx: update to 0.35.0 pkgsrc changes: --------------- * Add py-certbot/Makefile.common to make version number coherent upstream changes: ----------------- - Added o dns_rfc2136 plugin now supports explicitly specifing an authorative base domain for cases when the automatic method does not work (e.g. Split horizon DNS) - Fixed o Renewal parameter webroot_path is always saved, avoiding some regressions when webroot authenticator plugin is invoked with no challenge to perform. o Certbot now accepts OCSP responses when an explicit authorized responder, different from the issuer, is used to sign OCSP responses. o Scripts in Certbot hook directories are no longer executed when their filenames end in a tilde. - Despite us having broken lockstep, we are continuing to release new versions of all Certbot components during releases for the time being, however, the only package with changes other than its version number was: o certbot o certbot-dns-rfc2136
2019-06-10dropbear: Update to 2019.78nia4-41/+23
Changes: 2019.78 - 27 March 2019 - Fix dbclient regression in 2019.77. After exiting the terminal would be left in a bad state. Reported by Ryan Woodsmall 2019.77 - 23 March 2019 - Fix server -R option with ECDSA - only advertise one key size which will be accepted. Reported by Peter Krefting, 2018.76 regression. - Fix server regression in 2018.76 where multiple client -R forwards were all forwarded to the first destination. Reported by Iddo Samet. - Make failure delay more consistent to avoid revealing valid usernames, set server password limit of 100 characters. Problem reported by usd responsible disclosure team - Change handling of failed authentication to avoid disclosing valid usernames, CVE-2018-15599. - Fix dbclient to reliably return the exit code from the remote server. Reported by W. Mike Petullo - Fix export of 521-bit ECDSA keys, from Christian Hohnstädt - Add -o Port=xxx option to work with sshfs, from xcko - Merged fuzzing code, see FUZZER-NOTES.md - Add a DROPBEAR_SVR_MULTIUSER=0 compile option to run on single-user Linux kernels (CONFIG_MULTIUSER disabled). From Patrick Stewart - Increase allowed username to 100 characters, reported by W. Mike Petullo - Update config.sub and config.guess, should now work with RISC-V - Cygwin compile fix from karel-m - Don't require GNU sed (accidentally in 2018.76), reported by Samuel Hsu - Fix for IRIX and writev(), reported by Kazuo Kuroi - Other fixes and cleanups from François Perrad, Andre McCurdy, Konstantin Demin, Michael Jones, Pawel Rapkiewicz 2018.76 - 27 February 2018 > > > Configuration/compatibility changes IMPORTANT Custom configuration is now specified in localoptions.h rather than options.h Available options and defaults can be seen in default_options.h To migrate your configuration, compare your customised options.h against the upstream options.h from your relevant version. Any customised options should be put in localoptions.h in the build directory. - "configure --enable-static" should now be used instead of "make STATIC=1" This will avoid 'hardened build' flags that conflict with static binaries - Set 'hardened build' flags by default if supported by the compiler. These can be disabled with configure --disable-harden if needed. -Wl,-pie -Wl,-z,now -Wl,-z,relro -fstack-protector-strong -D_FORTIFY_SOURCE=2 # spectre v2 mitigation -mfunction-return=thunk -mindirect-branch=thunk Spectre patch from Loganaden Velvindron - "dropbear -r" option for hostkeys no longer attempts to load the default hostkey paths as well. If desired these can be specified manually. Patch from CamVan Nguyen - group1-sha1 key exchange is disabled in the server by default since the fixed 1024-bit group may be susceptible to attacks - twofish ciphers are now disabled in the default configuration - Default generated ECDSA key size is now 256 (rather than 521) for better interoperability - Minimum RSA key length has been increased to 1024 bits > > > Other features and fixes - Add runtime -T max_auth_tries option from Kevin Darbyshire-Bryant - Add 'dbclient -J &fd' to allow dbclient to connect over an existing socket. See dbclient manpage for a socat example. Patch from Harald Becker - Add "-c forced_command" option. Patch from Jeremy Kerr - Restricted group -G option added with patch from stellarpower - Support server-chosen TCP forwarding ports, patch from houseofkodai - Allow choosing outgoing address for dbclient with -b [bind_address][:bind_port] Patch from houseofkodai - Makefile will now rebuild object files when header files are modified - Add group14-256 and group16 key exchange options - curve25519-sha256 also supported without @libssh.org suffix - Update bundled libtomcrypt to 1.18.1, libtommath to 1.0.1 This fixes building with some recent versions of clang - Set PAM_RHOST which is needed by modules such as pam_abl - Improvements to DSS and RSA public key validation, found by OSS-Fuzz. - Don't exit when an authorized_keys file has malformed entries. Found by OSS-Fuzz - Fix null-pointer crash with malformed ECDSA or DSS keys. Found by OSS-Fuzz - Numerous code cleanups and small issues fixed by Francois Perrad - Test for pkt_sched.h rather than SO_PRIORITY which was problematic with some musl platforms. Reported by Oliver Schneider and Andrew Bainbridge - Fix some platform portability problems, from Ben Gardner - Add EXEEXT filename suffix for building dropbearmulti, from William Foster - Support --enable-<option> properly for configure, from Stefan Hauser - configure have_openpty result can be cached, from Eric Bénard - handle platforms that return close() < -1 on failure, from Marco Wenzel - Build and configuration cleanups from Michael Witten - Fix libtomcrypt/libtommath linking order, from Andre McCurdy - Fix old Linux platforms that have SYS_clock_gettime but not CLOCK_MONOTONIC - Update curve25519-donna implementation to current version
2019-06-10py-asyncssh: updated to 1.17.0adam2-7/+7
Release 1.17.0: Added support for “reverse direction” SSH connections, useful to support applications like NETCONF Call Home, described in RFC 8071. Added support for the PyCA implementation of Chacha20-Poly1305, eliminating the dependency on libnacl/libsodium to provide this functionality, as long as OpenSSL 1.1.1b or later is installed. Restored libnacl support for Curve25519/Ed25519 on systems which have an older version of OpenSSL that doesn’t have that support. This fallback also applies to Chacha20-Poly1305. Fixed Pageant support on Windows to use the Pageant agent by default when it is available and client keys are not explicitly configured. Disabled the use of RSA SHA-2 signatures when using the Pageant or Windows 10 OpenSSH agent on Windows, since neither of those support the signature flags options to request them. Fixed a regression where a callable was no longer usable in the sftp_factory argument of create_server.
2019-06-10py-paramiko: updated to 2.5.0adam3-8/+15
2.5.0: [Feature] Updated SSHConfig.lookup so it returns a new, type-casting-friendly dict subclass (SSHConfigDict) in lieu of dict literals. This ought to be backwards compatible, and allows an easier way to check boolean or int type ssh_config values. [Feature] Add support for Curve25519 key exchange (aka curve25519-sha256@libssh.org). [Feature] Add support for encrypt-then-MAC (ETM) schemes (hmac-sha2-256-etm@openssh.com, hmac-sha2-512-etm@openssh.com) and two newer Diffie-Hellman group key exchange algorithms (group14, using SHA256; and group16, using SHA512). Patch courtesy of Edgar Sousa. [Support] Update our install docs with (somewhat) recently added additional dependencies; we previously only required Cryptography, but the docs never got updated after we incurred bcrypt and pynacl requirements for Ed25519 key support. Additionally, pyasn1 was never actually hard-required; it was necessary during a development branch, and is used by the optional GSSAPI support, but is not required for regular installation. Thus, it has been removed from our setup.py and its imports in the GSSAPI code made optional. [Support] Add *.pub files to the MANIFEST so distributed source packages contain some necessary test assets. Credit: Alexander Kapshuna. [Support] Add support for the modern (as of Python 3.3) import location of MutableMapping (used in host key management) to avoid the old location becoming deprecated in Python 3.8. [Support] Raise Cryptography dependency requirement to version 2.5 (from 1.5) and update some deprecated uses of its API.
generated by cgit v1.2.3 (git 2.39.1) at 2024-10-09 19:22:27 +0000