summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2009-01-10From Sergey Svishchev <svs@ropnet.ru>: ipsec-tools builds fine on FreeBSDmanu1-2/+2
2009-01-09Fixed pkglint warnings about sorting SUBDIR.rillig1-3/+3
2009-01-08Update to openssl-0.9.8j. Fixes CVE-2008-5077.tnn5-32/+43
Changes between 0.9.8i and 0.9.8j [07 Jan 2009] *) Properly check EVP_VerifyFinal() and similar return values (CVE-2008-5077). *) Allow the CHIL engine to be loaded, whether the application is multithreaded or not. (This does not release the developer from the obligation to set up the dynamic locking callbacks.) *) Use correct exit code if there is an error in dgst command. *) Tweak Configure so that you need to say "experimental-jpake" to enable JPAKE, and need to use -DOPENSSL_EXPERIMENTAL_JPAKE in applications. *) Add experimental JPAKE support, including demo authentication in s_client and s_server. *) Set the comparison function in v3_addr_canonize(). *) Add support for XMPP STARTTLS in s_client. *) Change the server-side SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG behavior to ensure that even with this option, only ciphersuites in the server's preference list will be accepted. (Note that the option applies only when resuming a session, so the earlier behavior was just about the algorithm choice for symmetric cryptography.) Changes between 0.9.8h and 0.9.8i [15 Sep 2008] *) Fix a state transitition in s3_srvr.c and d1_srvr.c (was using SSL3_ST_CW_CLNT_HELLO_B, should be ..._ST_SW_SRVR_...). *) The fix in 0.9.8c that supposedly got rid of unsafe double-checked locking was incomplete for RSA blinding, addressing just one layer of what turns out to have been doubly unsafe triple-checked locking. So now fix this for real by retiring the MONT_HELPER macro in crypto/rsa/rsa_eay.c. *) Various precautionary measures: - Avoid size_t integer overflow in HASH_UPDATE (md32_common.h). - Avoid a buffer overflow in d2i_SSL_SESSION() (ssl_asn1.c). (NB: This would require knowledge of the secret session ticket key to exploit, in which case you'd be SOL either way.) - Change bn_nist.c so that it will properly handle input BIGNUMs outside the expected range. - Enforce the 'num' check in BN_div() (bn_div.c) for non-BN_DEBUG builds. *) Allow engines to be "soft loaded" - i.e. optionally don't die if the load fails. Useful for distros. *) Add support for Local Machine Keyset attribute in PKCS#12 files. *) Fix BN_GF2m_mod_arr() top-bit cleanup code. *) Expand ENGINE to support engine supplied SSL client certificate functions. This work was sponsored by Logica. *) Add CryptoAPI ENGINE to support use of RSA and DSA keys held in Windows keystores. Support for SSL/TLS client authentication too. Not compiled unless enable-capieng specified to Configure. This work was sponsored by Logica. *) Fix bug in X509_ATTRIBUTE creation: dont set attribute using ASN1_TYPE_set1 if MBSTRING flag set. This bug would crash certain attribute creation routines such as certifcate requests and PKCS#12 files.
2009-01-07Despite the fact that various Python modules do have buildlink files,tonnerre1-21/+0
according to Joerg this behavior is wrong. Remove this one again.
2009-01-07Add buildlink3.mk file to py-OpenSSL extension so it can be referenced intonnerre1-0/+21
other packages.
2009-01-07Update to 1.19:wiz2-6/+6
v1.19 2008.12.31 - fix verfycn_name autodetection from PeerAddr/PeerHost
2009-01-04Move scrollkeeper/omf.mk to rarian/omf.mk.wiz1-2/+2
scrollkeeper is nowadays included in rarian, so the omf.mk file should be there as well. Adapt all references.
2009-01-04+openvas-*adrianp1-1/+6
2009-01-04OpenVAS stands for Open Vulnerability Assessment System and is aadrianp34-0/+6560
network security scanner with associated tools like a graphical user front-end. The core component is a server with a set of network vulnerability tests (NVTs) to detect security problems in remote systems and applications.
2009-01-01Update amavisd-new to 2.6.2, maintainer update request by PR 40303.obache2-6/+6
amavisd-new-2.6.2 release notes MAIN NEW FEATURES SUMMARY - bounce killer: improved detection of nonstandard bounces; - bounces to be killed no longer waste SpamAssassin time; - tool to convert dkim-filter keysfile into amavisd configuration; - compatibility with SpamAssassin 3.3 (CVS head) regained; - rewritten and expanded documentation section on DKIM signing and verification in amavisd-new-docs.html; COMPATIBILITY WITH 2.6.1 - apart from small differences in logging and notifications, the version 2.6.2 is compatible with 2.6.1, with its configuration file and its environment; - virus scanner entries were updated (as described below, most notably by adding a regexp flag m), so be sure to update existing configuration file; updated virus scanner entries can be used with 2.6.1 too; - the %sql_clause default has changed in detail (see below), if its value is overridden in a configuration file the setting may need updating; See full release notes: http://www.ijs.si/software/amavisd/release-notes.txt
2008-12-30Fixed build (removed whirlpool) (ok by wiz)stacktic3-3/+33
2008-12-21This package isn't JOBS_SAFE.taca1-1/+2
2008-12-21PR# pkg/40146: security/policykit fails to build on Linuxjmcneill4-3/+56
2008-12-20PR# pkg/40230: "libvolume_id" doesn't build under Mac OS Xjmcneill5-5/+45
Fix PolicyKit build on OSX.
2008-12-19Added fixes for DESTDIR support:heinz6-14/+62
Correct settings for file ownership (*OWN, *GRP in patch-aa and patch-ao). Added missing installation directories in patch-aa. Sorted PLIST to placate pkglint. Adapted filename in patch-an to the way mkpatches generates nowadays.
2008-12-19Add p5-OpenSSL.he1-1/+2
2008-12-19Import p5-OpenSSL version 0.09.he3-0/+40
Fixes PR#39223. THIS IS A FUCKING HACK (nichts für die Goldwaage..) Don't read the man-pages/*.pm's (they are dummy), check t/* and fix OpenSSL.xs Don't forget to try - print OpenSSL::CRL::new_from_file("crl.pem")->info - it's the only CRL stuff that's supported :) OpenSSL::HMAC is dummy. OpenSSL::BN is untested.
2008-12-19Changes 2.6.3adam2-6/+6
* gnutls: Fix chain verification for chains that ends with RSA-MD2 CAs. * gnutls: Fix memory leak in PSK authentication. * certtool: Move gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM, 0) call earlier. It needs to be invoked before libgcrypt is initialized. * gnutls-cli: Return non-zero exit code on error conditions. * gnutls-cli: Corrected bug which caused a rehandshake request to be ignored.
2008-12-18Update from version 2.36nb1 to 2.38.he2-7/+6
Should fix PR#40189. Upstream changes: 2008-11-14 Gisle Aas <gisle@ActiveState.com> Release 2.38 The 2.37 tarball was infected by various '._*' files. Thank you, Mac OS X! Applied warning fix from Geoff Richards [RT#19643] Applied compatiblity fix from Alexandr Ciornii [RT#30348] 2008-11-12 Gisle Aas <gisle@ActiveState.com> Release 2.37 Sync up with consting changes from the perl core.
2008-12-18Update from version 1.17 to 1.18.he2-6/+6
Fixes PR#40188, though the dependency bump is not done (is not reflected in the module's META.yml). Upstream changes: v1.18 2008.11.17 - fixed typo in argument: wildcars_in_cn -> wildcards_in_cn http://rt.cpan.org/Ticket/Display.html?id=40997 thanks to ludwig[DOT]nussel[AT]suse[DOT]de for reporting
2008-12-15Update to 2.6.8. Apparently fixed some compilation issues (presumablysmb3-21/+6
due to GCC 4), though those aren't mentioned in the upstream change log. Other changes: 2007-06-09 gettextize <bug-gnu-gettext@gnu.org> * m4/gettext.m4: New file, from gettext-0.16.1. * m4/iconv.m4: New file, from gettext-0.16.1. * m4/lib-ld.m4: New file, from gettext-0.16.1. * m4/lib-link.m4: New file, from gettext-0.16.1. * m4/lib-prefix.m4: New file, from gettext-0.16.1. * m4/nls.m4: New file, from gettext-0.16.1. * m4/po.m4: New file, from gettext-0.16.1. * m4/progtest.m4: New file, from gettext-0.16.1. 2003-03-08 17:38 nmav * Makefile.am: Honor DESTDIR variable. Patch by Andrew W. Nosenko <awn@bcs.zp.ua> 2003-03-08 17:29 nmav * src/mcrypt.c, NEWS: Made the algorithm and mode command line input case insensitive. 2003-03-08 17:08 nmav * doc/mcrypt.1: some corrections in the manpage by Michael Mason <mgm@eskimoman.net>
2008-12-15gcc complains when an int is cast to a pointer of different size. Torillig2-1/+27
avoid that warning, the ints are first cast to size_t, which is more likely to match the size of a pointer. Unfortunately, the intptr_t and uintptr_t types are marked optional in C99.
2008-12-13* Fixes mismatch between the section and extension of skeyprune.obache10-11/+169
* skeyprune is perl script, need runtime dependency on perl5. * Fixes mis-use of config.h (patch-a[d-i]), avoid to use a mixture of local hash function with system RMD header. Fixes build failure reported by PR 39872 and PR 39953. Bump PKGREVISION.
2008-12-13Restore to original DESTDIR ready.obache3-7/+9
2008-12-13Use REPLACE_PERL instead of custom SUBST.obache1-6/+2
2008-12-13macro name must not contains '-', a part of PR 39953.obache3-6/+6
2008-12-12Fix build problem with USE_DESTDIR == no.taca2-4/+13
2008-12-11PR 40152 by Tim Zingelman:wiz3-3/+16
lib/krb5/os/dnsglue.c uses statbuf structure before zeroing it. Solaris requires it be zeroed first... all kerberos programs that use dns lookup crash. Zeroing before use does not break anything on any other platforms. Bump PKGREVISION.
2008-12-09Fixes perl module installation path, PR 40138 by Rumko.obache2-8/+5
Change to install into vendor and use packlist.
2008-12-07And pear-Mail_Mime while we're hereadrianp1-1/+2
2008-12-07DEPENDS+=mail/pear-Mailadrianp1-1/+3
PKGREVISION++
2008-12-05Add security/sslproxysborrill1-1/+2
2008-12-05The Symbion SSL Proxy listens on a TCP port, accepts SSL connections, andsborrill4-0/+35
forwards them to another (local or remote) TCP port, or UNIX domain socket.
2008-12-04Remove share/icons/hicolor/icon-theme.cache from PLIST, belongswiz2-3/+3
to hicolor-icon-them. Bump PKGREVISION.
2008-11-26* Use PolicyKit.conf.NetBSD on DragonFly as wellhasso1-4/+5
* DESTDIR support * Bump PKGREVISION
2008-11-25Correct patch-aa checksum, sorry for a mess.hasso1-2/+2
2008-11-24Changes 1.7:adam3-11/+12
- Add libtasn1-config for compatibility. Please stop use it as it will disappear in v2.0! Use standard AC_CHECK_FUNCS autoconf tests or pkg-config instead. - Read PKCS-12 blob as binary file, fixes self-tests under Mingw. - Fix use of __attribute__ ((deprecated)) to work on non-GCC. Changes 1.6: - Fixed namespace violation for MAX_NAME_SIZE and MAX_ERROR_DESCRIPTION_SIZE. The new names are ASN1_MAX_NAME_SIZE and ASN1_MAX_ERROR_DESCRIPTION_SIZE. - Fixed namespace violation for libtasn1_perror and libtasn1_strerror. The new names are asn1_perror and asn1_strerror. - Fix namespace violation for LIBASN1_VERSION. The new name is ASN1_VERSION. - Decoder can now decode BER encoded octet strings. - doc: Change license on the manual to GFDLv1.3+. - doc: Sync gdoc script with GnuTLS, changes license on man-pages to GAP. - doc: Improve gtk-doc manual. - Assumes system has strdup and string.h. - Remove libtasn1-config and libtasn1.m4, use standard AC_CHECK_FUNCS autoconf tests or pkg-config instead. - Change detection of when to use a linker version script, use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic.
2008-11-24Add missing build dependencies on libxslt and docbook-xsl, for creatingwiz1-1/+4
the man pages. No PKGREVISION bump because package didn't package.
2008-11-24enable hal, bump PKGREVISIONjmcneill1-1/+10
2008-11-23From FreeBSD:jmcneill2-1/+31
Fix a problem with PK's strndup() implementation assuming all strings passed to it would be NUL-terminated. This is known to fix crashes with polkit-gnome-authorization and clock-applet.
2008-11-23* Make it compile in DragonFlyhasso8-13/+88
* Fix permissions of suid/sgid binaries * Bump PKGREVISION
2008-11-23On NetBSD, install a default policy that allows password-less authenticationjmcneill2-1/+22
for root, password authentication for users in group wheel, and deny access to all others.
2008-11-22Add buildlink script for polkit-gnomejmcneill1-0/+22
2008-11-22Add a MESSAGE explaining that procfs is required for policykitjmcneill1-0/+9
2008-11-22Add policykit, policykit-gnomejmcneill1-1/+3
2008-11-22Import policykit-gnome version 0.9.2.jmcneill4-0/+116
PolicyKit is an application-level toolkit for defining and handling the policy that allows unprivileged processes to speak to privileged processes: It is a framework for centralizing the decision making process with respect to granting access to privileged operations for unprivileged applications. PolicyKit is specifically targeting applications in rich desktop environments on multi-user UNIX-like operating systems. It does not imply or rely on any exotic kernel features. This package provides a D-Bus session bus service for bringing up authentication dialogs used for obtaining privileges.
2008-11-22Import policykit version 0.9.jmcneill11-0/+242
PolicyKit is an application-level toolkit for defining and handling the policy that allows unprivileged processes to speak to privileged processes: It is a framework for centralizing the decision making process with respect to granting access to privileged operations for unprivileged applications. PolicyKit is specifically targeting applications in rich desktop environments on multi-user UNIX-like operating systems. It does not imply or rely on any exotic kernel features.
2008-11-21Try to deal with a bug described in security/39313, when the buildahoka1-2/+11
against recent openpam headers produce non functioning pam_ldap.so on NetBSD 4.99.47(?) or more recent systems. There's something really fishy in the headers...
2008-11-20Properly give up maintainership, as pointed out by wiz@ [hi he!].cube1-2/+2
2008-11-19The patch from upstream to fix man/man5/qop.5 symlink. This has been sit inhasso2-1/+18
PR 38622 for some time.
generated by cgit v1.2.3 (git 2.39.1) at 2024-10-11 22:21:06 +0000