summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2018-12-17security/ruby-sshkit: update to 1.18.0taca2-7/+7
## [1.18.0][] (2018-10-21) * [#435](https://github.com/capistrano/sshkit/pull/435): Consistent verbosity configuration #capture and #test methods - [@NikolayRys](https://github.com/NikolayRys) ## [1.17.0][] (2018-07-07) * [#430](https://github.com/capistrano/sshkit/pull/430): [Feature] Command Argument STDOUT/capistrano.log Hiding - [@NorseGaud](https://github.com/NorseGaud) ## [1.16.1][] (2018-05-20) * [#425](https://github.com/capistrano/sshkit/pull/425): Command#group incorrectly escapes double quotes, resulting in a a syntax error when specifying the group execution using `as`. This issue manifested when user command quotes changed from double quotes to single quotes. This fix removes the double quote escaping - [@pblesi](https://github.com/pblesi).
2018-12-17security/ruby-rbnacl: update to 6.0.0taca3-9/+13
## [6.0.0] (2018-11-08) [6.0.0]: https://github.com/crypto-rb/rbnacl/pull/182 * [#180](https://github.com/crypto-rb/rbnacl/pull/180) Deprecate rbnacl-libsodium. ([@tarcieri]) * [#176](https://github.com/crypto-rb/rbnacl/pull/176) Add support for XChaCha20-Poly1305. ([@AnIrishDuck]) * [#174](https://github.com/crypto-rb/rbnacl/pull/174) Fix buffer size type in `randombytes_buf` binding. ([@elijh]) * [#172](https://github.com/crypto-rb/rbnacl/pull/172) Add support for argon2id digest. ([@trofi]) * [#166](https://github.com/crypto-rb/rbnacl/pull/166) Support for non-32-byte HMAC-SHA256/512 keys. ([@nsheremet])
2018-12-17security/ruby-airbrussh: update to 1.3.1taca3-10/+10
## [1.3.1][] (2018-11-04) * Packaging changes to reduce gem size * RuboCop and Travis improvements * No user-facing changes
2018-12-16xml-security-c: Add a test target.nia1-1/+4
2018-12-16xml-security-c: Update to 2.0.2. Patch from maya.nia4-39/+20
Changes: 2.0.0: Bug [SANTUARIO-496] - DSA verification crashes OpenSSL on invalid combinations of key content 2.0.1: Bug [SANTUARIO-491] - Default KeyInfo resolver doesn't check for empty element content. 2.0.0: Bug [SANTUARIO-382] - Unconditionally enable large file support [SANTUARIO-418] - Invalid acceptance of unpadded RSA signatures [SANTUARIO-435] - Automake misses the subdir-objects option [SANTUARIO-437] - Cannot compile as C++11 [SANTUARIO-447] - XSECCryptoX509::loadX509PEM() can read past unterminated buffer [SANTUARIO-449] - TXFMOutputFile can try to close unopened stream [SANTUARIO-470] - dsig/DSIGReference.cpp:931: bad type ? [SANTUARIO-471] - Patch for C++11 compile failures [SANTUARIO-473] - Build failure using NSS [SANTUARIO-474] - Better overflow checking [SANTUARIO-479] - xml-security-cpp compilation errors Improvement [SANTUARIO-460] - Support for OpenSSL 1.1 [SANTUARIO-461] - Internal key store should be deleted on any CryptoAcquireContext() error [SANTUARIO-472] - Conditional inclusion of XMKS code in library [SANTUARIO-476] - Change default behavior for inferring attribute IDness by name
2018-12-16security/php-pecl-mcrypt: allow build with php73taca1-2/+2
2018-12-15*: update email for fhajnywiz7-14/+14
2018-12-15security/php-sodium: allow php73taca1-2/+2
Allow build with php73.
2018-12-15Needs pre-1.1 OpenSSL.schmonz1-1/+3
2018-12-13revbump for boost 1.69.0adam20-40/+40
2018-12-13correct directory, oopsbsiegert1-2/+2
2018-12-13py-bcrypt: updated to 3.1.5adam3-12/+10
3.1.5 Added support for compilation on AIX. Dropped Python 2.6 and 3.3 support. Switched to using abi3 wheels for Python 3. If you are not getting a wheel on a compatible platform please upgrade your pip version.
2018-12-13nettle: use c99gson1-2/+2
Add c99 to USE_LANGUAGES as nettle 3.4.1 uses c99 for loop syntax, and won't build on NetBSD 7.1 without it.
2018-12-13gnutls: Add a dependency to mozilla-rootcerts and configure to use themleot1-1/+5
Without providing `--with-default-trust-store-file=' configure argument gnutls try to check a list of hardcoded paths for the trust store file and use the first found. If none of them is found gnutls_certificate_set_x509_system_trust() returns GNUTLS_E_UNIMPLEMENTED_FEATURE and the location of trust store file should be provided (e.g. in gnutls-cli via --x509cafile option). Depends on mozilla-rootcerts and pass `--with-default-trust-store-file=' similarly to security/p11-kit to always have a consistent default trust store file and an implemented gnutls_certificate_set_x509_system_trust(). Bump PKGREVISION
2018-12-12p11-kit: Use `+=' to append to DEPENDS (not `=') (NFC)leot1-2/+2
2018-12-12gpgme: updated to 1.12.0adam2-7/+7
Noteworthy changes in version 1.12.0 * Enhanced the JSON based interface tool gpgme-json to support Native Messaging as well as new Javascript code to support the browser site. See lang/js/README for details. * Major overhaul of the Python language bindings documentation. * Even for old versions of gpg a missing MDC will now lead to a decryption failure. * Added context flag "auto-key-locate" to control the behavior of GPGME_KEYLIST_MODE_LOCATE. * New data function to create a data object from an estream. * Add more interfaces to the C++ bindings. * Improved error codes on decryption failure. * Lots of minor fixes.
2018-12-11Import gcr-3.28.0nb1 from wip.bsiegert6-1/+367
GCR is a library for displaying certificates, and crypto UI, accessing key stores. It also provides the viewer for crypto files on the GNOME desktop. GCK is a library for accessing PKCS#11 modules like smart cards, in a (G)object oriented way.
2018-12-09Removed commented-out PKGREVISIONsadam20-40/+20
2018-12-09gnutls: Update security/gnutls to 3.6.5leot4-16/+22
pkgsrc changes: - Remove comments regarding bash and tests (bash was added unconditionally due REPLACE_BASH usages) Changes: 3.6.5 ----- ** libgnutls: Provide the option of transparent re-handshake/reauthentication when the GNUTLS_AUTO_REAUTH flag is specified in gnutls_init() (#571). ** libgnutls: Added support for TLS 1.3 zero round-trip (0-RTT) mode (#127) ** libgnutls: The priority functions will ignore and not enable TLS1.3 if requested with legacy TLS versions enabled but not TLS1.2. That is because if such a priority string is used in the client side (e.g., TLS1.3+TLS1.0 enabled) servers which do not support TLS1.3 will negotiate TLS1.2 which will be rejected by the client as disabled (#621). ** libgnutls: Change RSA decryption to use a new side-channel silent function. This addresses a security issue where memory access patterns as well as timing on the underlying Nettle rsa-decrypt function could lead to new Bleichenbacher attacks. Side-channel resistant code is slower due to the need to mask access and timings. When used in TLS the new functions cause RSA based handshakes to be between 13% and 28% slower on average (Numbers are indicative, the tests where performed on a relatively modern Intel CPU, results vary depending on the CPU and architecture used). This change makes nettle 3.4.1 the minimum requirement of gnutls (#630). [CVSS: medium] ** libgnutls: gnutls_priority_init() and friends, allow the CTYPE-OPENPGP keyword in the priority string. It is only accepted as legacy option and is ignored. ** libgnutls: Added support for EdDSA under PKCS#11 (#417) ** libgnutls: Added support for AES-CFB8 cipher (#357) ** libgnutls: Added support for AES-CMAC MAC (#351) ** libgnutls: In two previous versions GNUTLS_CIPHER_GOST28147_CPB/CPC/CPD_CFB ciphers have incorrectly used CryptoPro-A S-BOX instead of proper (CryptoPro-B/-C/-D S-BOXes). They are fixed now. ** libgnutls: Added support for GOST key unmasking and unwrapped GOST private keys parsing, as specified in R 50.1.112-2016. ** gnutls-serv: It applies the default settings when no --priority option is given, using gnutls_set_default_priority(). ** p11tool: Fix initialization of security officer's PIN with the --initialize-so-pin option (#561) ** certtool: Add parameter --no-text that prevents certtool from outputting text before PEM-encoded private key, public key, certificate, CRL or CSR. ** API and ABI modifications: GNUTLS_AUTO_REAUTH: Added GNUTLS_CIPHER_AES_128_CFB8: Added GNUTLS_CIPHER_AES_192_CFB8: Added GNUTLS_CIPHER_AES_256_CFB8: Added GNUTLS_MAC_AES_CMAC_128: Added GNUTLS_MAC_AES_CMAC_256: Added gnutls_record_get_max_early_data_size: Added gnutls_record_send_early_data: Added gnutls_record_recv_early_data: Added gnutls_db_check_entry_expire_time: Added gnutls_anti_replay_set_add_function: Added gnutls_anti_replay_init: Added gnutls_anti_replay_deinit: Added gnutls_anti_replay_set_window: Added gnutls_anti_replay_enable: Added gnutls_privkey_decrypt_data2: Added
2018-12-09nettle: Update security/nettle to 3.4.1leot3-10/+11
Changes: 3.4.1 ----- This release fixes a few bugs, and makes the RSA private key operations side channel silent. The RSA improvements are contributed by Simo Sorce and Red Hat, and include one new public function, rsa_sec_decrypt, see below. All functions using RSA private keys are now side-channel silent, meaning that they try hard to avoid any branches or memory accesses depending on secret data. This applies both to the bignum calculations, which now use GMP's mpn_sec_* family of functions, and the processing of PKCS#1 padding needed for RSA decryption. Nettle's ECC functions were already side-channel silent, while the DSA functions still aren't. There's also one caveat regarding the improved RSA functions: due to small table lookups in relevant mpn_sec_* functions in GMP-6.1.2, the lowest and highest few bits of the secret factors p and q may still leak. I'm not aware of any attacks on RSA where knowing a few bits of the factors makes a significant difference. This leak will likely be plugged in later GMP versions. Changes in behavior: * The functions rsa_decrypt and rsa_decrypt_tr may now clobber all of the provided message buffer, independent of the actual message length. They are side-channel silent, in that branches and memory accesses don't depend on the validity or length of the message. Side-channel leakage from the caller's use of length and return value may still provide an oracle useable for a Bleichenbacher-style chosen ciphertext attack. Which is why the new function rsa_sec_decrypt is recommended. New features: * A new function rsa_sec_decrypt. It differs from rsa_decrypt_tr in that the length of the decrypted message is given a priori, and PKCS#1 padding indicating a different length is treated as an error. For applications that may be subject to chosen ciphertext attacks, it is recommended to initialize the message area with random data, call this function, and ignore the return value. This applies in particular to RSA-based key exchange in the TLS protocol. Bug fixes: * Fix bug in pkcs1-conv, missing break statements in the parsing of PEM input files. * Fix link error on the pss-mgf1-test test, affecting builds without public key support. Performance regression: * All RSA private key operations employing RSA blinding, i.e., rsa_decrypt_tr, rsa_*_sign_tr, the new rsa_sec_decrypt, and rsa_compute_root_tr, are significantly slower. This is because (i) RSA blinding now use side-channel silent operations, (ii) blinding includes a modular inversion, and (iii) side-channel silent modular inversion, implemented as mpn_sec_invert, is very expensive. A 60% slowdown for 2048-bit RSA keys have been measured. Miscellaneous: * Building the public key support of nettle now requires GMP version 6.0 or later (unless --enable-mini-gmp is used). The shared library names are libnettle.so.6.5 and libhogweed.so.4.5, with sonames still libnettle.so.6 and libhogweed.so.4. It is intended to be fully binary compatible with nettle-3.1.
2018-12-09revbump after updating textproc/icuadam30-59/+60
2018-12-09libgpg-error: update distinfoadam1-2/+1
2018-12-09libgpg-error: updated to 1.33adam4-24/+10
Noteworthy changes in version 1.33: * New unified config script gpgrt-config which can now be used by all GnuPG related packages. * Support for ARC and arm64ilp32. * The log functions now sanitize strings printed with the "%s" format specifier. All control characters are C-escaped in the output. Users of that function may want to remove their own escaping to avoid doubling of backslashes. * New fprintf style function to apply a custom filter for string arguments. * New function to compare version strings.
2018-12-07Update to 0.063wen2-7/+7
Upstream changes: 0.063 2018-11-28 - proper patch for #46 (related to Math::BigInt::LTM)
2018-12-05libssh: fix pkgconfig file.wiz1-2/+5
Fix build on NetBSD by removing -Werror=strict-overflow. Bump PKGREVISION.
2018-12-03libssh: updated to 0.8.5adam8-82/+61
version 0.8.5: * Added support to get known_hosts locations with ssh_options_get() * Fixed preferred algorithm for known hosts negotiations * Fixed KEX with some server implementations (e.g. Cisco) * Fixed issues with MSVC * Fixed keyboard-interactive auth in server mode (regression from CVE-2018-10933) * Fixed gssapi auth in server mode (regression from CVE-2018-10933) * Fixed socket fd handling with proxy command * Fixed a memory leak with OpenSSL version 0.8.4: * Fixed CVE-2018-10933 * Fixed building without globbing support * Fixed possible memory leaks * Avoid SIGPIPE on sockets version 0.8.3: * Added support for rsa-sha2 * Added support to parse private keys in openssh container format (other than ed25519) * Added support for diffie-hellman-group18-sha512 and diffie-hellman-group16-sha512 * Added ssh_get_fingerprint_hash() * Added ssh_pki_export_privkey_base64() * Added support for Match keyword in config file * Improved performance and reduced memory footprint for sftp * Fixed ecdsa publickey auth * Fixed reading a closed channel * Added support to announce posix-rename@openssh.com and hardlink@openssh.com in the sftp server version 0.8.2: * Added sha256 fingerprints for pubkeys * Improved compiler flag detection * Fixed race condition in reading sftp messages * Fixed doxygen generation and added modern style * Fixed library initialization on Windows * Fixed __bounded__ attribute detection * Fixed a bug in the options parser * Fixed documentation for new knwon_hosts API version 0.8.1: * Fixed version number in the header * Fixed version number in pkg-config and cmake config * Fixed library initialization * Fixed attribute detection version 0.8.0: * Removed support for deprecated SSHv1 protocol * Added new connector API for clients * Added new known_hosts parsing API * Added support for OpenSSL 1.1 * Added support for chacha20-poly1305 cipher * Added crypto backend for mbedtls crypto library * Added ECDSA support with gcrypt backend * Added advanced client and server testing using cwrap.org * Added support for curve25519-sha256 alias * Added support for global known_hosts file * Added support for symbol versioning * Improved ssh_config parsing * Improved threading support
2018-11-30sudo: fix PLIST (new locales)triaxx1-1/+4
2018-11-29polkit: make sure target directory for config file copying exists.wiz1-2/+3
Bump PKGREVISION.
2018-11-29Revbump for libcanberra gstreamer change.prlw13-6/+6
2018-11-28Updated package security/ocaml-cryptokit to version 1.13.jaapb3-10/+9
Changes are bugfixes and minor additions.
2018-11-27Need pthread support, make sure a substitue is present if OS lacks supportsevan1-2/+2
natively, e.g Minix at present.
2018-11-27Support Minix.sevan4-29/+208
2018-11-27Updated package security/ocaml-safepass to use dune. Revbump.jaapb2-5/+5
2018-11-27Removed superfluous patch file from security/ocaml-ssljaapb1-15/+0
2018-11-27Updated package security/ocaml-ssl to version 0.5.7.jaapb4-27/+24
Changes include minor bugfixes and a change of the build system to dune.
2018-11-27py-asyncssh: updated to 1.15.0adam2-7/+7
Release 1.15.0: Added the ability to pass keyword arguments provided in the scp() command through to asyncssh.connect() calls it makes, allowing things like custom credentials to be specified. Added support for a reuse_port argument in create_server(). If set, this will be passed to the asyncio loop.create_server() call which creates listening sockets. Added support for “soft” EOF when line editing in enabled so that EOF can be signalled multiple times on a channel. When Ctrl-D is received on a channel with line editing enabled, EOF is returned to the application but the channel remains open and capable of accepting more input, allowing an interactive shell to process the EOF for one command but still accept input for subsequent commands. Added support for the Windows 10 OpenSSH ssh-agent. Thanks go to SamP20 for providing an initial proof of concept and a suggested implementation. Reworked scoped link-local IPv6 address normalization to work better on Linux systems. Fixed a problem preserving directory structure in recursive scp(). Fixed SFTP chmod tests to avoid attempting to set the sticky bit on a plain file, as this caused test failures on FreeBSD. Updated note in SSHClientChannel’s send_signal() documentation to reflect that OpenSSH 7.9 and later should now support processing of signal messages.
2018-11-27py-cryptodome: updated to 3.7.2adam2-7/+7
3.7.2: Fixed compilation problem on ARM platforms.
2018-11-25py-cryptodome: updated to 3.7.1adam3-17/+91
3.7.1: New features Added type stubs to enable static type checking with mypy. New update_after_digest flag for CMAC. Resolved issues Fixed problem with gcc 4.x when compiling ghash_clmul.c. Incorrect digest value produced by CMAC after cloning the object. Method update() of an EAX cipher object was returning the underlying CMAC object, instead of the EAX object itself. Method update() of a CMAC object was not throwing an exception after the digest was computed (with digest() or verify()).
2018-11-23Recursive revbump from multimedia/libvaryoon1-2/+2
2018-11-22Enable acmeshryoon1-1/+2
2018-11-22security/acmesh: import acmesh-2.7.9ryoon4-0/+58
A pure Unix shell script implementing ACME client protocol * An ACME protocol client written purely in Shell (Unix shell) language. * Full ACME protocol implementation. * Support ACME v1 and ACME v2 * Support ACME v2 wildcard certs * Simple, powerful and very easy to use. You only need 3 minutes to learn it. * Bash, dash and sh compatible. * Simplest shell script for Let's Encrypt free certificate client. * Purely written in Shell with no dependencies on python or the official Let's Encrypt client. * Just one script to issue, renew and install your certificates automatically. * DOES NOT require root/sudoer access. * Docker friendly * IPv6 support
2018-11-21py-cryptography[_vectors]: updated to 2.4.2adam4-15/+15
2.4.2: Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.0j.
2018-11-14Revbump after cairo 1.16.0 update.kleink18-36/+36
2018-11-14Revbump packages depending on gedit after bl3 change.bsiegert1-2/+2
2018-11-14sudo: Fix PLISTleot1-2/+2
share/doc/sudo/schema.olcSudo is installed only when ldap support is enabled.
2018-11-14sudo: updated to 1.8.26adam3-8/+9
What's new in Sudo 1.8.26 * Fixed a bug in cvtsudoers when converting to JSON format when alias expansion is enabled. * Sudo no long sets the USERNAME environment variable when running commands. This is a non-standard environment variable that was set on some older Linux systems. * Sudo now treats the LOGNAME and USER environment variables (as well as the LOGIN variable on AIX) as a single unit. If one is preserved or removed from the environment using env_keep, env_check or env_delete, so is the other. * Added support for OpenLDAP's TLS_REQCERT setting in ldap.conf. * Sudo now logs when the command was suspended and resumed in the I/O logs. This information is used by sudoreplay to skip the time suspended when replaying the session unless the new -S flag is used. * Fixed documentation problems found by the igor utility. * Sudo now prints a warning message when there is an error or end of file while reading the password instead of exiting silently. * Fixed a bug in the sudoers LDAP back-end parsing the command_timeout, role, type, privs and limitprivs sudoOptions. This also affected cvtsudoers conversion from LDIF to sudoers or JSON. * Fixed a bug that prevented timeout settings in sudoers from functioning unless a timeout was also specified on the command line. * Asturian translation for sudo from translationproject.org. * When generating LDIF output, cvtsudoers can now be configured to pad the sudoOrder increment such that the start order is used as a prefix. * Fixed a bug introduced in sudo 1.8.25 that prevented sudo from properly setting the user's groups on AIX. * If the user specifies a group via sudo's -g option that matches any of the target user's groups, it is now allowed even if no groups are present in the Runas_Spec. Previously, it was only allowed if it matched the target user's primary group. * The sudoers LDAP back-end now supports negated sudoRunAsUser and sudoRunAsGroup entries. * Sudo now provides a proper error message when the "fqdn" sudoers option is set and it is unable to resolve the local host name. * Portuguese translation for sudo and sudoers from translationproject.org. * Sudo now includes sudoers LDAP schema for the on-line configuration supported by OpenLDAP.
2018-11-14py-argon2_cffi: updated to 18.3.0adam2-7/+7
18.3.0: Changes: - argon2.PasswordHasher's hash type is configurable now. 18.2.0: Changes: - The hash type for argon2.PasswordHasher is Argon2\ **id** now. This decision has been made based on the recommendations in the latest Argon2 RFC draft <https://tools.ietf.org/html/draft-irtf-cfrg-argon2-03#section-4>_. - To make the change of hash type backward compatible, argon2.PasswordHasher.verify() now determines the type of the hash and verifies it accordingly. - Some of the hash parameters have been made stricter to be closer to said recommendations. The current goal for a hash verification times is around 50ms. - To allow for bespoke decisions about upgrading Argon2 parameters, it's now possible to extract them from a hash via the argon2.extract_parameters() function. - Additionally argon2.PasswordHasher now has a check_needs_rehash() method that allows to verify whether a hash has been created with the instance's parameters or whether it should be rehashed.
2018-11-13py-m2crypto: updated to 0.31.0adam2-8/+8
0.31.0: - Compatibility with OpenSSL 1.1.1 (partly workaround, maybe requires further investigation) - Fixes for Windows builds - Fixes of installs on AWS Lambda - Fixes of Mac OS X related failures - Fix Python 2.6 compatibility issues
2018-11-13py-cryptography[_vectors]: updated to 2.4.1adam6-27/+64
2.4.1: Fixed a build breakage in our manylinux1 wheels. 2.4: BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL 2.4.x. Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no longer supported by the OpenSSL project. At this time there is no time table for dropping support, however we strongly encourage all users to upgrade or install cryptography from a wheel. Added initial :doc:OCSP </x509/ocsp> support. Added support for :class:~cryptography.x509.PrecertPoison.
2018-11-12Revbumps associated with update of lang/ocaml.jaapb6-11/+12
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-07 05:23:11 +0000