summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2021-08-30libssh2: updated to 1.10.0adam3-29/+9
libssh2 1.10 This release includes the following enhancements and bugfixes: o adds agent forwarding support o adds OpenSSH Agent support on Windows o adds ECDSA key support using the Mbed TLS backend o adds ECDSA cert authentication o adds diffie-hellman-group14-sha256, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512 key exchanges o adds support for PKIX key reading when using ed25519 with OpenSSL o adds support for EWOULDBLOCK on VMS systems o adds support for building with OpenSSL 3 o adds support for using FIPS mode in OpenSSL o adds debug symbols when building with MSVC o adds support for building on the 3DS o adds unicode build support on Windows o restores os400 building o increases min, max and opt Diffie Hellman group values o improves portiablity of the make file o improves timeout behavior with 2FA keyboard auth o various improvements to the Wincng backend o fixes reading parital packet replies when using an agent o fixes Diffie Hellman key exchange on Windows 1903+ builds o fixes building tests with older versions of OpenSSL o fixes possible multiple definition warnings o fixes potential cast issues _libssh2_ecdsa_key_get_curve_type() o fixes potential use after free if libssh2_init() is called twice o improved linking when using Mbed TLS o fixes call to libssh2_crypto_exit() if crypto hasn't been initialized o fixes crash when loading public keys with no id o fixes possible out of bounds read when exchanging keys o fixes possible out of bounds read when reading packets o fixes possible out of bounds read when opening an X11 connection o fixes possible out of bounds read when ecdh host keys o fixes possible hang when trying to read a disconnected socket o fixes a crash when using the delayed compression option o fixes read error with large known host entries o fixes various warnings o fixes various small memory leaks o improved error handling, various detailed errors will now be reported o builds are now using OSS-Fuzz o builds now use autoreconf instead of a custom build script o cmake now respects install directory o improved CI backend o updated HACKING-CRYPTO documentation o use markdown file extensions o improved unit tests
2021-08-30security/ccid: Update to 1.4.36gdt2-7/+7
1.4.36 - 30 August 2021, Ludovic Rousseau - Add support of - Lenovo Lenovo Smartcard Wired Keyboard II - REINER SCT tanJack USB - SafeNet eToken 5110+ FIPS - SafeNet eToken 5300 C - jSolutions s.r.o. Multi SIM card reader 4/8 - parse: fix check when bNumDataRatesSupported = 0
2021-08-30libssh: update to 0.96.wiz3-10/+10
version 0.9.6 (released 2021-08-26) * CVE-2021-3634: Fix possible heap-buffer overflow when rekeying with different key exchange mechanism * Fix several memory leaks on error paths * Reset pending_call_state on disconnect * Fix handshake bug with AEAD ciphers and no HMAC overlap * Use OPENSSL_CRYPTO_LIBRARIES in CMake * Ignore request success and failure message if they are not expected * Support more identity files in configuration * Avoid setting compiler flags directly in CMake * Support build directories with special characters * Include stdlib.h to avoid crash in Windows * Fix sftp_new_channel constructs an invalid object * Fix Ninja multiple rules error * Several tests fixes
2021-08-30libgcrypt: update to 1.9.4.wiz3-34/+7
Noteworthy changes in version 1.9.4 (2021-08-22) [C23/A3/R4] ------------------------------------------------ * Bug fixes: - Fix Elgamal encryption for other implementations. [#5328,CVE-2021-33560] - Fix alignment problem on macOS. [#5440] - Check the input length of the point in ECDH. [#5423] - Fix an abort in gcry_pk_get_param for "Curve25519". [#5490] * Other features: - Add GCM and CCM to OID mapping table for AES. [a83fb13a3b]
2021-08-29py-trustme: updated to 0.9.0adam3-9/+10
0.9.0: Unknown changes
2021-08-27Upgrade security/vault to version 1.6.6.he2-9/+9
Pkgsrc changes: * Note that we need go >= 1.15.15. Upstream changes: 26 August 2021 SECURITY: * UI Secret Caching: The Vault UI erroneously cached and exposed user-viewed secrets between authenticated sessions in a single shared browser, if the browser window / tab was not refreshed or closed between logout and a subsequent login. This vulnerability, CVE-2021-38554, was fixed in Vault 1.8.0 and will be addressed in pending 1.7.4 / 1.6.6 releases. CHANGES: * go: Update go version to 1.15.15 [GH-12423] IMPROVEMENTS: * db/cassandra: Added tls_server_name to specify server name for TLS validation [GH-11820] BUG FIXES: * physical/raft: Fix safeio.Rename error when restoring snapshots on windows [GH-12377] * secret: fix the bug where transit encrypt batch doesn't work with key_version [GH-11628] * secrets/database: Fixed an issue that prevented external database plugin processes from restarting after a shutdown. [GH-12087] * ui: Automatically refresh the page when user logs out [GH-12035] * ui: Fixes metrics page when read on counter config not allowed [GH-12348] * ui: fix oidc login with Safari [GH-11884]
2021-08-27security: Spell R-gitcreds correctly.jperkin3-2/+2
Should hopefully unbreak bulk builds.
2021-08-26mit-krb5: updated to 1.18.4adam2-8/+7
Major changes in 1.18.4 Fix a denial of service attack against the KDC encrypted challenge code [CVE-2021-36222]. Fix a memory leak when gss_inquire_cred() is called without a credential handle.
2021-08-25openssl: fix building on Darwinadam3-3/+18
2021-08-25openssl: Update to 1.1.1l.jperkin5-33/+13
Changes between 1.1.1k and 1.1.1l [24 Aug 2021] *) Fixed an SM2 Decryption Buffer Overflow. In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. (CVE-2021-3711) [Matt Caswell] *) Fixed various read buffer overruns processing ASN.1 strings ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). (CVE-2021-3712) [Matt Caswell]
2021-08-24Only use -z nodelete linker flag if it is available.manu5-28/+79
This should fix the build on platforms that do not use GNU ld such as MacOSX.
2021-08-24(security/R-{oskeyring,gitgreds}) Added version 0.1.1mef1-1/+3
Added security/R-oskeyring version 0.1.1 Added security/R-gitgreds version 0.1.1
2021-08-24security/R-gitgreds: import R-gitcreds-0.1.1mef3-0/+25
Query, set, delete credentials from the 'git' credential store. Manage 'GitHub' tokens and other 'git' credentials. This package is to be used by other packages that need to authenticate to 'GitHub' and/or other 'git' repositories.
2021-08-24security/R-oskeyring: import R-oskeyring-0.1.1mef3-0/+24
Aims to support all features of the system credential store, including non-portable ones. Supports 'Keychain' on 'macOS', and 'Credential Manager' on 'Windows'. See the 'keyring' package if you need a portable 'API'.
2021-08-24py-acme-tiny: updated to 4.1.1adam4-26/+28
Release 4.1.1 CHANGELOG * Support already valid authorizations * Moved to Github Actions workflows for automated tests, started using Let's Encrypt pebble test server, increased test coverage to 100% * Added test to ensure path traversal can't be exploited * Started logging Account IDs for later reference * Various README updates
2021-08-23acmesh: Update to 3.0.0ryoon3-9/+11
Changelog: Zerossl.com is set a default CA now: https://github.com/acmesh-official/acme.sh/wiki/Change-default-CA-to-ZeroSSL SSL.com is supported now: https://github.com/acmesh-official/acme.sh/wiki/SSL.com-CA Add more retry logic for unstable network connections. More dns apis are aded. Bug fixes.
2021-08-21tor-browser: update to 10.5.5.wiz2-12/+12
Bug 40582: Tor Browser 10.5.2 tabs always crash on Fedora Xfce Rawhide
2021-08-19Prevent dynamic unload of libp11-kit.somanu4-9/+44
The library sets up a pthread_atfork() hook. If we let be unload, we get a callback to stale memory.
2021-08-18Add files I forgot to cvs addmanu2-0/+1997
Thanks to wiz@ for pointing out
2021-08-18More decoding of TLS values, especially TLSv1.3 ciphersmanu3-1334/+5
Not submitted upstream, as it is an abandonware.
2021-08-15*: recursive bump for openexr 3.1wiz1-2/+2
2021-08-15tor-browser: update to 10.5.4.wiz3-15/+13
This version updates Firefox to 78.13.0esr. This version includes important security updates to Firefox. Warning: Tor Browser will stop supporting version 2 onion services very soon. Please see the previously published deprecation timeline. Migrate your services and update your bookmarks to version 3 onion services as soon as possible. The full changelog since Tor Browser 10.5.2: Windows + OS X + Linux Update Firefox to 78.13.0esr Update NoScript to 11.2.11 Bug 40041: Remove V2 Deprecation banner on about:tor for desktop Bug 40506: Saved Logins not available in 10.5 Bug 40524: Update DuckDuckGo onion site URL in search preferences and onboarding
2021-08-15tor-browser-noscript: update to 11.2.11.wiz2-8/+11
v 11.2.11 ============================================================ x [nscl] Fixed JavaScript access to CSS rules broken on Chromium when unrestricted CSS is disabled - issue #204 x Prevent Chromium builds from being sent to AMO for signing x [nscl] Fixed CPU/RAM overload on some pages with unrestricted CSS disabled but scripting enabled (not recommended setting) - issue #194, issue #199 x [nscl] Fixed CPU spikes on Chromium triggered by automatic file downloads (thanks ptheborg for report) v 11.2.10 ============================================================ x Cross-browser file naming consistency, in spite of version numbering incompatibilities x [nscl] Fix for potential race conditions on certain page transitions (issue #205) x Handle exception when accessing navigator.serviceWorker on sandboxed frames x MS Edge support v 11.2.9 ============================================================ x [L10n] Updated de, mk x Replace deprecated extension.getURL() with runtime.getURL() x REUSE-compliant licensing boilerplate x Remove unused/refactored-out files x Relicensing as GPL3+ x [nscl] Fixed infinite recursion issue on window.open wrappers x Avoid treating JavaScript files as embeddings when opened as top-level documents
2021-08-12putty: remove patch that was removed from distinfo during 0.76 updatewiz1-13/+0
2021-08-11Revbump all Go packages after go116 updatebsiegert8-16/+16
2021-08-11py-google-auth-oauthlib: updated to 0.4.5adam2-7/+7
0.4.5 (2021-07-26) Documentation fix links to installed app, client secrets docs omit mention of Python 2.7 in 'CONTRIBUTING.rst' add Samples section to CONTRIBUTING.rst
2021-08-11py-google-auth: updated to 1.34.0adam2-7/+7
v1.34.0 Features support refresh callable on google.oauth2.credentials.Credentials Bug Fixes do not use the GAE APIs on gen2+ runtimes
2021-08-07security/gpg-tui: update to 0.7.4pin3-58/+88
[0.7.4] - 2021-08-07 Added: Add config for splash screen to check SHA256 hash of assets Changed: Bump rust-embed to 6.0.0 Bump tui to 0.16.0 Bump gpgme to 0.10.0 Center the options menu title Fixed: Mark the unsupported algorithms as unrecognized/unknown Fix the failing test about options menu title
2021-08-05py-acme py-certbot*: updated to 1.18.0adam33-138/+139
1.18.0 Added New functions that Certbot plugins can use to interact with the user have been added to certbot.display.util. We plan to deprecate using IDisplay with zope in favor of these new functions in the future. The Plugin, Authenticator and Installer classes are added to certbot.interfaces module as alternatives to Certbot's current zope based plugin interfaces. The API of these interfaces is identical, but they are based on Python's abc module instead of zope. Certbot will continue to detect plugins that implement either interface, but we plan to drop support for zope based interfaces in a future version of Certbot. The class certbot.configuration.NamespaceConfig is added to the Certbot's public API. Changed When self-validating HTTP-01 challenges using acme.challenges.HTTP01Response.simple_verify, we now assume that the response is composed of only ASCII characters. Previously we were relying on the default behavior of the requests library which tries to guess the encoding of the response which was error prone. acme: the .client.Client and .client.BackwardsCompatibleClientV2 classes are now deprecated in favor of .client.ClientV2. The certbot.tests.patch_get_utility* functions have been deprecated. Plugins should now patch certbot.display.util themselves in their tests or use certbot.tests.util.patch_display_util as a temporary workaround. In order to simplify the transition to Certbot's new plugin interfaces, the classes Plugin and Installer in certbot.plugins.common module and certbot.plugins.dns_common.DNSAuthenticator now implement Certbot's new plugin interfaces. The Certbot plugins based on these classes are now automatically detected as implementing these interfaces. We added a dependency on chardet to our acme library so that it will be used over charset_normalizer in newer versions of requests. Fixed The Apache authenticator no longer crashes with "Unable to insert label" when encountering a completely empty vhost. This issue affected Certbot 1.17.0. Users of the Certbot snap on Debian 9 (Stretch) should no longer encounter an "access denied" error when installing DNS plugins.
2021-08-02security/pleaser: update to 0.4.2pin2-11/+10
-Fix example -Check should fail if handed a non-regular file -Document control characters -Optional environment passthrough -Removing superfluous backtick -Child should be handled in parent -Removing redundant util.rs -Reorganising tests to storage overheads -Clippy suggestions -Removing need to drop privs in child -Forking can be done as low priv user
2021-08-02security/gpg-tui: update to 0.7.3pin3-14/+13
[0.7.3] - 2021-07-25 Added: -Add Wayland clipboard support (#30) -Add 'in the media' section to README.md Changed: -Import the test key from keyserver in CI workflow Fixed: -Handle clipboard errors
2021-07-30*: Recursive revbump from audio/pulseaudio-15.0ryoon8-14/+16
2021-07-29tor-browser-https-everywhere: update to 2021.7.13.wiz2-7/+10
2021.7.13 * Amend Incognito Key for Chrome and Firefox #20092 * Fix unexpected arithmetic operations on strings #20043 * Remove Top Alexa Labeller #20083 * Update deprecated log function #20101 * Patch Chrome Test Failure #20102
2021-07-27py-google-auth: updated to 1.33.1adam3-8/+11
1.33.1 (2021-07-20) Bug Fixes fallback to source creds expiration in downscoped tokens Reverts revert "feat: service account is able to use a private token endpoint 1.33.0 (2021-07-14) Features define CredentialAccessBoundary classes define google.auth.downscoped.Credentials class service account is able to use a private token endpoint Bug Fixes fix fetch_id_token credential lookup order to match adc Documentation fix code block formatting in 'user-guide.rst' 1.32.1 (2021-06-30) Bug Fixes avoid leaking sub-session created for '_auth_request' 1.32.0 (2021-06-16) Features allow scopes for self signed jwt 1.31.0 (2021-06-09) Features define useful properties on google.auth.external_account.Credentials Bug Fixes avoid deleting items while iterating
2021-07-25security/ccid: Update to 1.4.35gdt2-12/+7
packaging changes: stop re-running bootstrap. upstream documents just running configure, and regen causes trouble. upstream changes are minor
2021-07-24putty: Update to 0.67ryoon4-54/+18
Changelog: These features are new in 0.76 (released 2021-07-17): New option to abandon an SSH connection if the server allows you to authenticate in a trivial manner. Bug fix: Windows PuTTY crashed when the 'Use system colours' option was used. Bug fix: crash on Windows when using MIT Kerberos together with 'Restart Session'. Bug fix: Windows PuTTY leaked named pipes after contacting Pageant. Bug fix: Windows PuTTY didn't update the window while you held down the scrollbar arrow buttons long enough to 'key-repeat'. Bug fix: user colour-palette reconfiguration via 'Change Settings' were delayed-action. Bug fix: server colour-palette reconfigurations were sometimes lost. Bug fix: a tight loop could occur on reading a truncated private key file. Bug fix: the Windows Pageant GUI key list didn't display key lengths. These features were new in 0.75 (released 2021-05-08): Security fix: on Windows, a server could DoS the whole Windows GUI by telling the PuTTY window to change its title repeatedly at high speed. Pageant now supports loading a key still encrypted, and decrypting it later by prompting for the passphrase on first use. Upgraded default SSH key fingerprint format to OpenSSH-style SHA-256. Upgraded private key file format to PPK3, with improved passphrase hashing and no use of SHA-1. Terminal now supports ESC [ 9 m for strikethrough text. New protocols: bare ssh-connection layer for use over already-secure IPC channels, and SUPDUP for talking to very old systems such as PDP-10s. PuTTYgen now supports alternative provable-prime generation algorithm for RSA and DSA. The Unix tools can now connect directly to a Unix-domain socket.
2021-07-24security/wolfssl: Updates to v4.8.1fox2-7/+7
Changes since v4.8.0: wolfSSL Release 4.8.1 (July 16, 2021) Release 4.8.1 of wolfSSL embedded TLS has an OCSP vulnerability fix: Vulnerabilities * [High] OCSP verification issue when response is for a certificate with no relation to the chain in question BUT that response contains the NoCheck extension which effectively disables ALL verification of that one cert. Users who should upgrade to 4.8.1 are TLS client users doing OCSP, TLS server users doing mutual auth with OCSP, and CertManager users doing OCSP independent of TLS. Thanks to Jan Nauber, Marco Smeets, Werner Rueschenbaum and Alissa Kim of Volkswagen Infotainment for the report.
2021-07-23py-acme, py-certbot*: updated to 1.17.0adam18-83/+86
Certbot 1.17.0 Added Add Void Linux overrides for certbot-apache. Changed We changed how dependencies are specified between Certbot packages. For this and future releases, higher level Certbot components will require that lower level components are the same version or newer. More specifically, version X of the Certbot package will now always require acme>=X and version Y of a plugin package will always require acme>=Y and certbot=>Y. Specifying dependencies in this way simplifies testing and development. The Apache authenticator now always configures virtual hosts which do not have an explicit ServerName. This should make it work more reliably with the default Apache configuration in Debian-based environments. Fixed When we increased the logging level on our nginx "Could not parse file" message, it caused a previously-existing inability to parse empty files to become more visible. We have now added the ability to correctly parse empty files, so that message should only show for more significant errors.
2021-07-22acmesh: fix sub-folder installation for notify and dnsapi supporttm2-4/+196
It's required to install sub-folders which contains scripts for notify and dnsapi support. Change default folder for scripts to share folder and symlink to sbin. Bump PKGREVISION.
2021-07-22g/c RUSTFLAGS from individual package Makefiles. Handled by cargo.mk.tnn1-2/+1
2021-07-20security/gpg-tui: update to 0.7.2pin2-7/+7
[0.7.2] - 2021-07-20 Added: -Add the missing views for signature notations Changed: -Mark the default signing key with a symbol Fixed: -Override the default key for all gpg fallback commands -Sleep the event handler thread if input is disabled (#29)
2021-07-20py-kerberos: mark as only supporting mit-krb5wiz1-1/+5
With heimdal, you'll get undefined symbol errors like this one: /usr/pkg/lib/python3.8/site-packages/kerberos.so: Undefined PLT symbol "krb5_free_keytab_entry_contents" Bump PKGREVISION.
2021-07-20security/ca-certifcates: Extned DESCRgdt1-1/+6
Note that this package is irregular because it modifies configuration outside of pkgsrc. Add a see-also for mozilla-rootcerts{,-openssl}.
2021-07-19security/gpg-tui: update to 0.7.1pin3-13/+14
[0.7.1] - 2021-07-17 Added: -Add an example for selection mode to README.md Changed: -Update README.md about libxkbcommon-dev dependency (#26) Fixed: -Run the terminal on stderr and use stdout for output (#27)
2021-07-18PR 55733 Joern Clausen: use GNU m4 with security/openssl on Solaris.dholland1-1/+2
Seems that Solaris's m4 overflows internal limits.
2021-07-15tor-browser: update to 10.5.2.wiz3-53/+67
10.5.2 Windows + OS X + Linux Update Firefox to 78.12.0esr Bug 40497: Cannot set multiple pages as home pages in 10.5a17 Bug 40507: Full update is not downloaded after applying partial update fails Bug 40510: open tabs get redirected to about:torconnect on restart 10.5.1 Android-only 10.5 All Platforms Update NoScript to 11.2.9 Update Tor Launcher to 0.2.30 Translations update Bug 25483: Provide Snowflake based on Pion for Windows, macOS, and Linux Bug 33761: Remove unnecessary snowflake dependencies Bug 40064: Bump libevent to 2.1.12 Bug 40137: Migrate https-everywhere storage to idb Bug 40261: Bump versions of snowflake and webrtc Bug 40263: Update domain front for Snowflake Bug 40302: Update version of snowflake Bug 40030: DuckDuckGo redirect to html doesn't work Windows + OS X + Linux Bug 27476: Implement about:torconnect captive portal within Tor Browser [tor-browser] Bug 32228: Bookmark TPO support domains in Tor Browser Bug 33803: Add a secondary nightly MAR signing key [tor-browser] Bug 33954: Consider different approach for Bug 2176 Bug 34345: "Don't Bootstrap" Startup Mode Bug 40011: Rename tor-browser-brand.ftl to brand.ftl Bug 40012: Fix about:tor not loading some images in 82 Bug 40138: Move our primary nightly MAR signing key to tor-browser Bug 40209: Implement Basic Crypto Safety Bug 40428: Correct minor Cryptocurrency warning string typo Bug 40429: Update Onboarding for 10.5 Bug 40455: Block or recover background requests after bootstrap Bug 40456: Update the SecureDrop HTTPS-Everywhere update channel Bug 40475: Include clearing CORS preflight cache Bug 40478: Onion alias url rewrite is broken Bug 40484: Bootstrapping page show Quickstart text Bug 40490: BridgeDB bridge captcha selection is broken in alpha Bug 40495: Onion pattern is focusable by click on about:torconnect Bug 40499: Onion Alias doesn't work with TOR_SKIP_LAUNCH Linux Bug 40089: Remove CentOS 6 support for Tor Browser 10.5 Build System All Platforms Update Go to 1.15.13 Bug 23631: Use rootless containers [tor-browser-build] Bug 33693: Change snowflake and meek dummy address [tor-browser] Bug 40016: getfpaths is not setting origin_project Bug 40169: Update apt package cache after calling pre_pkginst, too Bug 40194: Remove osname part in cbindgen filename Windows + OS X + Linux Bug 40081: Build Mozilla code with --enable-rust-simd Bug 40104: Use our TMPDIR when creating our .mar files Bug 40133: Bump Rust version for ESR 78 to 1.43.0 Bug 40166: Update apt cache before calling pre_pkginst in container-image config Linux Bug 26238: Move to Debian Jessie for our Linux builds Bug 31729: Support Wayland Bug 40041: Remove CentOS 6 support for 10.5 series Bug 40103: Add i386 pkg-config path for linux-i686 Bug 40112: Strip libstdc++ we ship Bug 40118: Add missing libdrm dev package to firefox container Bug 40235: Bump apt for Jessie containers
2021-07-15security/wolfssl: Updates to v4.8.0fox4-8/+35
Changes since v4.7.0: wolfSSL Release 4.8.0 (July 09, 2021) Release 4.8.0 of wolfSSL embedded TLS has bug fixes and new features including: Vulnerabilities * [Low] OCSP request/response verification issue. In the case that the serial number in the OCSP request differs from the serial number in the OCSP response the error from the comparison was not resulting in a failed verification. We recommend users that have wolfSSL version 4.6.0 and 4.7.0 with OCSP enabled update their version of wolfSSL. Version 4.5.0 and earlier are not affected by this report. Thanks to Rainer, Roee, Barak, Hila and Shoshi (from Cymotive and CARIAD) for the report. * [Low] CVE-2021-24116: Side-Channel cache look up vulnerability in base64 PEM decoding for versions of wolfSSL 4.5.0 and earlier. Versions 4.6.0 and up contain a fix and do not need to be updated for this report. If decoding a PEM format private key using version 4.5.0 and older of wolfSSL then we recommend updating the version of wolfSSL used. Thanks to Florian Sieck, Jan Wichelmann, Sebastian Berndt and Thomas Eisenbarth for the report. New Feature Additions New Product * Added wolfSentry build with --enable-wolfsentry and tie-ins to wolfSSL code for use with wolfSentry Ports * QNX CAAM driver added, supporting ECC black keys, CMAC, BLOBs, and TRNG use * _WIN32_WCE wolfCrypt port added * INTIME_RTOS directory support added * Added support for STM32G0 * Renesas RX: Added intrinsics for rot[rl], revl (thanks @rliebscher) * Added support for running wolfcrypt/test/testwolfcrypt on Dolphin emulator to test DEVKITPRO port * Zephyr project port updated to latest version 2.6.X ASN1 and PKCS * Storing policy constraint extension from certificate added * Added support for NID_favouriteDrink pilot * Added the API function wc_EncryptPKCS8Key to handle encrypting a DER, PKCS#8-formatted key Compatibility Layer Additions * Open Source PORTS Added/Updated * OpenVPN * OpenLDAP * socat-1.7.4.1 * Updated QT port for 5.15.2 * Changes to extend set_cipher_list() compatibility layer API to have set_ciphersuites compatibility layer API capability * Added more support for SHA3 in the EVP layer * API Added * MD5/MD5_Transform * SHA/SHA_Transform/SHA1_Transform * SHA224/SHA256_Transform/SHA512_Transform * SSL_CTX_get0_param/SSL_CTX_set1_param * X509_load_crl_file * SSL_CTX_get_min_proto_version * EVP_ENCODE_CTX_new * EVP_ENCODE_CTX_free * EVP_EncodeInit * EVP_EncodeUpdate * EVP_EncodeFinal * EVP_DecodeInit * EVP_DecodeUpdate * EVP_DecodeFinal * EVP_PKEY_print_public * BIO_tell * THREADID_current * THREADID_hash * SSL_CTX_set_ecdh_auto * RAND_set_rand_method() * X509_LOOKUP_ctrl() * RSA_bits * EC_curve_nist2nid * EC_KEY_set_group * SSL_SESSION_set_cipher * SSL_set_psk_use_session_callback * EVP_PKEY_param_check * DH_get0_pqg * CRYPTO_get_ex_new_index * SSL_SESSION_is_resumable * SSL_CONF_cmd * SSL_CONF_CTX_finish * SSL_CTX_keylog_cb_func * SSL_CTX_set_keylog_callback * SSL_CTX_get_keylog_callback Misc. * Added wolfSSL_CTX_get_TicketEncCtx getter function to return the ticket encryption ctx value * Added wc_AesKeyWrap_ex and wc_AesKeyUnWrap_ex APIs to accept an Aes object to use for the AES operations * Added implementation of AES-GCM streaming (--enable-aesgcm-stream) * Added deterministic generation of k with ECC following RFC6979 when the macro WOLFSL_ECDSA_DETERMINISTIC_K is defined and wc_ecc_set_deterministic function is called * Implemented wc_DsaParamsDecode and wc_DsaKeyToParamsDer * Asynchronous support for TLS v1.3 TLSX ECC/DH key generation and key agreement * Added crypto callback support for Ed/Curve25519 and SHA2-512/384 * TLS 1.3 OPwolfSSL_key_update_response function added to see if a update response is needed Fixes * Fix for detecting extra unused bytes that are in an ASN1 sequence appended to the end of a valid ECC signature * Fix for keyid with ktri CMS (breaks compatibility with previous keyid ASN1 syntax) * Fix for failed handshake if a client offers more than 150 cipher suites. Thanks to Marcel Maehren, Philipp Nieting, Robert Merget from Ruhr University Bochum Sven Hebrok, Juraj Somorovsky from Paderborn University * Fix for default order of deprecated elliptic curves SECP224R1, SECP192R1, SECP160R1. Thanks to Marcel Maehren, Philipp Nieting, Robert Merget from Ruhr University Bochum Sven Hebrok, Juraj Somorovsky from Paderborn University * Fix for corner TLS downgrade case where a TLS 1.3 setup that allows for downgrades but has TLS 1.3 set as the minimum version would still downgrade to TLS 1.2 PKCS7 (Multiple fixes throughout regarding memory leaks with SMIME and heap buffer overflows due to streaming functionality) * Fix PKCS7 dynamic content save/restore in PKCS7_VerifySignedData * Fix for heap buffer overflow on compare with wc_PKCS7_DecryptKtri * Fix for heap buffer overflow with wc_PKCS7_VerifySignedData * Fix for heap buffer overflow with wc_PKCS7_DecodeEnvelopedData * Check size of public key used with certificate passed into wc_PKCS7_InitWithCert before XMEMCPY to avoid overflow * Fix for heap buffer overflow fix for wolfSSL_SMIME_read_PKCS7 * Fix to cleanly free memory in error state with wolfSSL_SMIME_read_PKCS7 * SMIME error checking improvements and canonicalize multi-part messages before hashing DTLS Fixes * DTLS fix to correctly move the Tx sequence number forward * DTLS fix for sequence and epoch number with secure renegotiation cookie exchange * Fix for Chacha-Poly AEAD for DTLS 1.2 with secure renegotiation PORT Fixes * Fix AES, aligned key for the HW module with DCP port * Fix ATECC608A TNGTLS certificate size issue (thanks @vppillai) * Fixes for mingw compile warnings * Fixes for NXP LTC ECC/RSA * Fix ESP32 RSA hw accelerator initialization issue * Fixes for STM32 PKA with ECC * Fixes for STM32 AES GCM for HAL's that support byte sized headers * Espressif ESP32 SHA_CTX macro conflict resolved Math Library Fixes * For platforms that support limits.h or windows make sure both SIZEOF_LONG_LONG and SIZEOF_LONG are set to avoid issues with CTC_SETTINGS * SP C 32/64: fix corner cases around subtraction affecting RSA PSS use * Fix to return the error code from sp_cond_swap_ct when malloc fails * Fix potential memory leak with small stack in the function fp_gcd * Static Analysis Fixes * Fixes made from Coverity analysis including: * Cleanups for some return values, * Fix for leak with wolfSSL_a2i_ASN1_INTEGER * Sanity check on length in wolfSSL_BN_rand * Sanity check size in TLSX_Parse catching a possible integer overflow * Fixes found with -fsanitize=undefined testing * Fix null dereferences or undefined memcpy calls * Fix alignment in myCryptoDevCb * Fix default DTLS context assignment * Added align configure option to force data alignment Misc. * Fix for wolfSSL_ASN1_TIME_adj set length * Fix for freeing structure on error case in the function AddTrustedPeer * Return value of SSL_read when called after bidirectional shutdown * Fix for build options ./configure --enable-dtls --disable-asn * FIx for detection of a salt length from an RSA PSS signature * Fix to free up globalRNGMutex mutex when cleaning up global RNG * Fix leak when multiple hardware names are in SAN * Fix nonblocking ret value from CRL I/O callbacks * Fix wolfSSL_BIO_free_all return type to better match for compatibility layer * Fix for make distcheck, maintainer-clean, to allow distribution builds * Fix for async with fragmented packets * Fix for the build or RSA verify or public only * Fix for return value of wolfSSL_BIO_set_ssl to better match expected compatibility layer return value * Fix for sanity checks on size of issuer hash and key along with better freeing on error cases with DecodeBasicOcspResponse * Fix for potential memory leak with wolfSSL_OCSP_cert_to_id Improvements/Optimizations DTLS/TLS Code Base * Improved TLS v1.3 time rollover support * TLS 1.3 PSK: use the hash algorithm to choose cipher suite * TLS Extended Master Secret ext: TLS13 - send in second Client Hello if in first * TLS Encrypt then MAC: check all padding bytes are the same value * wolfSSL_GetMaxRecordSize updated to now take additional cipher data into account * Updated session export/import with DTLS to handle a new internal options flag * Refactored dtls_expected_peer_handshake_number handling * Added wolfSSL_CTX_get_ephemeral_key and wolfSSL_get_ephemeral_key for loading a constant key in place of an ephemeral one * Improved checking of XSNPRINTF return value in DecodePolicyOID Build Options and Warnings * Added wolfSSL_CTX_set_verify to the ABI list * Adjusted FP_ECC build to not allow SECP160R1, SECP160R2, SECP160K1 and SECP224K1. FP_ECC does not work with scalars that are the length of the order when the order is longer than the prime. * Added CMake support for CURVE25519, ED25519, CURVE448, and ED448 * cmake addition to test paths when building * Added support for session tickets in CMake * Added support for reproducible builds with CMake * Turn on reproducible-build by default when enable-distro * Windows Project: Include the X448 and Ed448 files * GCC-11 compile time warning fixes * Fix for compiling build of ./configure '--disable-tlsv12' '-enable-pkcallbacks' * Added build error for insecure build combination of secure renegotiation enabled with extended master secret disabled when session resumption is enabled * Updated building and running with Apple M1 * Apache httpd build without TLS 1.3 macro guard added * Enable SHA3 and SHAKE256 requirements automatically when ED448 is enabled * Added option for AES CBC cipher routines to return BAD_LENGTH_E when called with an input buffer length not a multiple of AES_BLOCK_SIZE * Macro WOLFSSL_SP_INT_DIGIT_ALIGN added for alignment on buffers with SP build. This was needed for compiler building on a Renesas board. * Build support with no hashes enabled an no RNG compiled in * Allow use of FREESCALE hardware RNG without a specific port * Resolved some warnings with Windows builds and PBKDF disabled * Updated the version of autoconf and automake along with fixes for some new GCC-10 warnings Math Libraries * SP: Thumb implementation that works with clang * SP math all: sp_cmp handling of negative values * SP C ECC: mont sub - always normalize after sub before check for add * TFM math library prime checking, added more error checks with small stack build * Sanity checks on 0 value with GCD math function * fp_exptmod_ct error checking and small stack variable free on error * Sanity check on supported digit size when calling mp_add_d in non fastmath builds * Support for mp_dump with SP Math ALL * WOLFSSL_SP_NO_MALLOC for both the normal SP build and small SP build now * WOLFSSL_SP_NO_DYN_STACK added for SP small code that is not small stack build to avoid dynamic stack PKCS 7/8 * wc_PKCS7_DecodeCompressedData to optionally handle a packet without content wrapping * Added setting of content type parsed with PKCS7 wc_PKCS7_DecodeAuthEnvelopedData and wc_PKCS7_DecodeEnvelopedData * PKCS8 code improvements and refactoring Misc. * Sanity checks on null inputs to the functions wolfSSL_X509_get_serialNumber and wolfSSL_X509_NAME_print_ex * Added ARM CryptoCell support for importing public key with wc_ecc_import_x963_ex() * Improved checking for possible use of key->dp == NULL cases with ECC functions * Updated SHAKE256 to compile with NIST FIPS 202 standard and added support for OID values (thanks to strongX509) * Improved ECC operations when using WOLFSSL_NO_MALLOC * Added WOLFSSL_SNIFFER_FATAL_ERROR for an return value when sniffer is in a fatal state * Allow parsing spaces in Base64_SkipNewline * Issue callback when exceeding depth limit rather than error out with OPENSSL_EXTRA build * Added NXP LTC RSA key generation acceleration For additional vulnerability information visit the vulnerability page at https://www.wolfssl.com/docs/security-vulnerabilities/ See INSTALL file for build instructions. More info can be found on-line at https://wolfssl.com/wolfSSL/Docs.html
2021-07-13go-crypto: get rid of Makefile.commonbsiegert2-22/+13
The go-crypto-acme package no longer exists, so the common Makefile is no longer needed.
2021-07-13Revbump all Go packages after go116 updatebsiegert8-15/+16
2021-07-10openssl: Stop passing CFLAGS/LDFLAGS to configure.jperkin1-2/+1
If this ever worked it only did by accident. Specifying, for example, "-arch arm64" as used on macOS is enough to break its custom configure script that assumes all arguments start with "-". The flags seem to propogate through the environment normally.
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-13 00:41:22 +0000