summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2016-04-14SunOS needs an explicit -lnsl.jperkin1-1/+2
2016-04-14py-service_identity from version 16.0.0 also needs attrs moduleleot1-2/+4
(hi wiz! :)) DEPENDS on devel/py-attrs now that we have it and bump PKGREVISION. While here also simplify MASTER_SITE.
2016-04-13Update p5-Net-SSLeay to 1.74.wiz2-8/+7
1.74 2016-04-12 README.OSX was missing from the distribution 1.73 2016-04-11 Added X509_get_X509_PUBKEY. Patch supplied by GUILHEM. Thanks. Added README.OSX with instructions on how to build for recent OS X. Added info about using OPENSSL_PREFIX to README.Win32. Added comments in POD about installation documentation. Added '/usr/local/opt/openssl/bin/openssl' to Openssl search path for latest version of OSX homebrew openssl. Patch from Shoichi Kaji.
2016-04-13Update gnupg2 to 2.0.30.wiz3-26/+7
Noteworthy changes in version 2.0.30 (2016-03-31) ------------------------------------------------- * gpg: Avoid too early timeout during key generation with 2.1 cards. * agent: Fixed printing of ssh fingerprints for 384 bit ECDSA keys. * agent: Fixed an alignment bug related to the passphrase confirmation. * scdaemon: Fixed a "conflicting usage" bug. * scdaemon: Fixed usb card reader removal problem on Windows 8 and later. * Fixed a problem on AIX due to peculiarity with RLIMIT_NOFILE. * Updated the Japanese and Dutch translations. * Fixed a few other bugs.
2016-04-13Update py-rsa to 3.4.1:wiz2-7/+7
Version 3.4.1 - released 2006-03-26 ---------------------------------------- - Included tests/private.pem in MANIFEST.in - Included README.md and CHANGELOG.txt in MANIFEST.in
2016-04-13Update to 2.55wen2-8/+7
Upstream changes: 2016-03-09 Gisle Aas <gisle@ActiveState.com> Release 2.55 Gordon Stanton (2): Make use warnings work including test cases. Initial Travis config Gisle Aas (1): Avoid warning: 'static' is not at beginning of declaration [RT#105646]
2016-04-12Fix build on SunOS. Fix pkglint warnings while at it.fhajny3-7/+25
Problem isolated and solution provided by @Kurlon https://github.com/joyent/pkgsrc/pull/350
2016-04-12Use ${MASTER_SITE_LOCAL} when you mean ${MASTER_SITE_LOCAL}.wiz1-3/+2
2016-04-11Recursive revbump from textproc/icu 57.1ryoon12-23/+24
2016-04-10Avoid creating a fake zlib.pc, because if it doesdbj1-1/+5
gnutls will add a Requires.private for it in its .pc file
2016-04-08Update py-cryptography to 1.3.1.wiz3-8/+14
1.3.1 - 2016-03-21 ~~~~~~~~~~~~~~~~~~ * Fixed a bug that caused an ``AttributeError`` when using ``mock`` to patch some ``cryptography`` modules. 1.3 - 2016-03-18 ~~~~~~~~~~~~~~~~ * Added support for padding ANSI X.923 with :class:`~cryptography.hazmat.primitives.padding.ANSIX923`. * Deprecated support for OpenSSL 0.9.8. Support will be removed in ``cryptography`` 1.4. * Added support for the :class:`~cryptography.x509.PolicyConstraints` X.509 extension including both parsing and generation using :class:`~cryptography.x509.CertificateBuilder` and :class:`~cryptography.x509.CertificateSigningRequestBuilder`. * Added :attr:`~cryptography.x509.CertificateSigningRequest.is_signature_valid` to :class:`~cryptography.x509.CertificateSigningRequest`. * Fixed an intermittent ``AssertionError`` when performing an RSA decryption on an invalid ciphertext, ``ValueError`` is now correctly raised in all cases. * Added :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier`.
2016-04-08Update p5-IO-Socket-SSL to 2.025.wiz2-7/+7
2.025 2016/04/04 - Resolved memleak if SSL_crl_file was used: RT#113257, RT#113530 Thanks to avi[DOT]maslati[AT]forescout[DOT]com and mark[DOT]kurman[AT]gmail[DOT]com for reporting the problem
2016-04-08Update p5-Crypt-PWSafe3 to 1.22.wiz2-7/+7
1.22: Records created by Crypt::PWSafe3 (eg. the ones fetched with getrecords) are now associated with the parent object, so that you can modify them directly and call $vault->save afterwards without using $vault->modifyrecord. Erase passwd from memory using zeros instead of random bytes. fixes github#9. Fixed rt.cpan.org#112975: Crypt::ECB (which we use) have been reworked and among other issues it fixed handline of padding. PWSafe3.pm did not specify a padding scheme (because it doesn't use it) and therefore Crypt::ECB enforced a default scheme which lead to an invalid key size. Now we specify explicitly padding:none, as suggested by Christoph Appel.
2016-04-07Update to 2.15wen2-7/+7
Upstream changes: v2.15, 14.03.2016 - removing caching with v2.00 made Crypt::ECB ignorant of key changes within the same Crypt::ECB object. Fixed, changing the key now forces a new cipher object to be created. - added some notes on upgrading from versions before v2.00 to the README
2016-04-06Added BUILD_DEPENDS+=xterm>=322:../../x11/xterm in order to quickly fix:imil1-1/+3
"xterm" binary not found - please amend $PATH or the cssh config file ok wiz@
2016-04-04Fix build with API differences in xulrunner.joerg5-3/+84
2016-04-04Explicitly depend on the mozilla CA list for providing a trust anchor.joerg1-1/+6
NetBSD doesn't ship a CA bundle by default.
2016-04-01Support PKGMANDIR.jperkin2-6/+8
2016-04-01Honour --mandir. Fixes PKGMANDIR.jperkin2-1/+14
2016-04-01Support PKGMANDIR.jperkin2-1/+19
2016-04-01Support PKGMANDIR.jperkin2-1/+19
2016-04-01Support --mandir. Fixes PKGMANDIR.jperkin2-1/+17
2016-03-30Use PKGMANDIR. Add patch comment.jperkin2-5/+8
2016-03-30Use PKGMANDIR. Add patch comment.jperkin2-6/+8
2016-03-29Remove support for SSLv2khorben3-26/+45
This fixes the build with the newest OpenSSL from pkgsrc. Bump revision.
2016-03-29Remove SSLv2 support. Bump revision.joerg3-3/+27
2016-03-24Update py-rsa to 3.4.wiz2-7/+7
Fixes a security vulnerability. No proper changelog found, which I find even more astonishing for security software...
2016-03-20Fix pinentry configure argument.wiz1-2/+2
Found by coypu.
2016-03-20Release Notes - OpenSAML 2 - C++ - Version 2.5.5pettai3-10/+9
** Bug * [CPPOST-91] - BOOST autoconf macros break with gcc5 Release Notes - OpenSAML 2 - C++ - Version 2.5.4 ** Bug * [CPPOST-87] - legacyOrgNames doesn't work as expected with empty mdui:UIInfo * [CPPOST-88] - Insufficient XML entity encoding in Metadata Status generation * [CPPOST-90] - Condition validation for empty element incorrectly requires either a NotBefore or a NotOnOrAfter attribute This is part of fixing PR pkg/50354
2016-03-20Update to 5.5.4ryoon3-13/+18
* Based on Firefox 38.7.1 * Fix PR pkg/50975: security/tor-browser is built without -pie * Store cache in ~/.tor-browser-caches instead of ~/Caches
2016-03-18Fix build on 64 bit intel systems with yasm installed.tez1-1/+2
2016-03-15Update openssh to 7.2.2 (7.2p2).bsiegert8-110/+57
Changes since OpenSSH 7.2p1 =========================== This release fixes a security bug: * sshd(8): sanitise X11 authentication credentials to avoid xauth command injection when X11Forwarding is enabled. Full details of the vulnerability are available at: http://www.openssh.com/txt/x11fwd.adv
2016-03-15Missed one checksum update... fixed.tez1-2/+2
2016-03-15Update to 1.14.1 resolving all reported vulnerabilities including:tez34-790/+241
CVE-2015-2695 CVE-2015-2696 CVE-2015-2697 CVE-2015-2698 CVE-2015-8629 CVE-2015-8630 CVE-2015-8631
2016-03-15Update HOMEPAGE.taca3-28/+13
Changes from 0.4.7 are too many to write here, please refer commit log: <https://github.com/oauth-xx/oauth-ruby/commits/master>.
2016-03-15Update ruby-bcrypt to 3.1.11.taca2-7/+7
3.1.11 Mar 06 2016 - Add support for Ruby 2.2 in compiled Windows binaries
2016-03-14Update to 5.5.3ryoon3-29/+8
Changelog: Rebase to Firefox 38.7.0
2016-03-14Update to 0.67ryoon2-7/+7
Changelog: 2016-03-05 PuTTY 0.67 released, fixing a SECURITY HOLE PuTTY 0.67, released today, fixes a security hole in 0.66 and before: vuln-pscp-sink-sscanf. It also contains a few other small bug fixes. Also, for the first time, the Windows executables in this release (including the installer) are signed using an Authenticode certificate, to help protect against tampering in transit from our website or after downloading. You should find that they list "Simon Tatham" as the verified publisher.
2016-03-14Update lasso to 2.5.1manu4-10/+15
Changes since 2.4.1 from NEWS file: 2.5.1 - February 19th 2016 --------------------------- 17 commits, 16 files changed, 1096 insertions, 42 deletions - Add missing urn constants used in PAOS HTTP header - Set NotBefore in SAML 2.0 login assertions - tests: fix leak in test test16_test_get_issuer - id-ff: fix leak of profile->private_data->message_id - saml-2.0: fix leak of message_id in lasso_profile_saml20_build_paos_request_msg - tests: fix leaks in test_ecp - xml: fix wrong termination of comment - xml: fix leak in lasso_soap_envelope_new_full - profile: fix leak of private idp_list field - saml-2.0: fix leaks of url - tests: fix leak - tests: update valgrind suppressions - perl: remove quotes from $PERL -V::ccflags: output (#9572) - Fix wrong snippet type (fixes #9616). Thanks to Brett Gardner for the patch. - tools.c: use correct NID and digest length when building RSA signature using SHA-2 digest (fixes #10019) Thanks to Brett Gardner for the patch. - bindings/php5: fix enum getters and setters (fixes #10032). Thanks to Brett Gardner for the bug report. - fix warning about INCLUDES directive 2.5.0 - September 2nd 2015 -------------------------- 151 commits, 180 files changed, 8391 insertions, 1339 deletions - lots of bugfixes (reported by static analysis tools like clang, coverity and manual inspection) thanks to Simo Sorce and John Dennis from RedHat - xsd:choices are now parsed correctly by implementing a real finite automata for parsing XML documents. New flag for jumping forward and backward in schema snippets have been added. It fixes parsing of message from third party not following the ordre from the schema (they are entitled to do it but most SAML implementations do not) - added C CGI examples for SP and IdP side - removed the _POSIX_SOURCE declaration - added support for the SHA-2 family of hash functions - fixed protocol profile selection when parsing AuthnRequest - added support for Python 3, thanks to Houzefa Abbasbhay from XCG Consulting - fixed default value of WantAuthnRequestSigned in metadata parsing - SAML 2.0 ECP is now functionnal, thanks to John Dennis from RedHat - added two new API function to LassoProfile to extract the Issuer and InResponseTo attribute of messages, allowing pre-treatment before parsing the message, to load the metadata of the remote provider, or find the request which the response matches. - fixed segfault when parsing HTTP-Redirect marlformed base64 content - added support for automake 1.15 (jdennis)
2016-03-13Update p5-Crypt-ECB to 2.10:wiz2-7/+7
v2.10, 07.03.2016 - forgot another change in the v2.00 changelog... - changed license from GPL to Artistic - improved kwalitee: - added license information to meta files - removed test.pl - added eg/ecb.pl (command line en- and decryption) - added dummy cipher, so the test suite makes sense even if there are no block ciphers installed - refactored test data from test scripts
2016-03-13Bump PKGREVISION by chaging default version of Ruby.taca2-4/+4
2016-03-13Update to 0.22.1ryoon5-30/+59
Changelog: 0.22.1 (stable) * Use SubjectKeyIdentifier for CKA_ID when available [#84761] * Allow 'BEGIN PuBLIC KEY' PEM blocks in .p11-kit files * Bump libtool library version * Build fixes [#84665 ...] 0.22.0 (stable) * Remove the 'isolated = yes' option due to unclear semantics replacement forth coming in later versions. * Use secure_getenv() where necessary * Run separate binary for 'p11-kit remote' command 0.21.3 (unstable) * New public pkcs11x.h header containing extensions [#83495] * Export necessary defines to lookup attached extensions [#83495] * Use term 'attached extensions' rather than 'stabled extensions' * Make proxy module respect 'critical = no' [#83651] * Show public-key-info in 'trust list --details' * Build fixes [#75674 ...] 0.21.2 (unstable) * Don't use invalid keys for looking up stapled extensions [#82328] * Better error messages when invalid certificate extensions * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files * Fix some leaks, and memory issues * Silence some clang scanner warnings * Fix build against older pthread implementations [#82617] * Move to a non-recursive Makefile * Can now specify which tests to run on command line 0.21.1 (unstable) * Add new 'isolate' pkcs11 config option [#80472] * Add 'p11-kit remote' command for isolating modules [#54105] * Don't complain about C_Finalize after a fork * Other minor fixes 0.20.3 (stable) * Fix problems reinitializing managed modules after fork * Fix bad bookeeping when fail initializing one of the modules * Fix case where module would be unloaded while in use [#74919] * Remove assertions when module used before initialized [#74919] * Fix handling of mmap failure and mapping empty files [#74773] * Stable p11_kit_be_quiet() and p11_kit_be_loud() functions * Require automake 1.12 or later * Build fixes for Windows [#76594 #74149] 0.20.2 (stable) * Fix bug where blacklist didn't affect extracted ca-anchors if the anchor and blacklist were not in the same trust path (regression) [#73558] * Check for race in BasicConstraints stapled extension [#69314] * autogen.sh now runs configure as srcdir != builddir by default * Build fixes and cleanup 0.20.1 (stable) * Extract compat trust data after we've changes * Skip compat extraction if running as non-root * Better failure messages when removing anchors * Build cleanup 0.20.0 (stable) * Doc fixes 0.19.4 (unstable) * 'trust anchor' now adds/removes certificate anchors * 'trust list' lists trust policy stuff * 'p11-kit extract' is now 'trust extract' * 'p11-kit extract-trust' is now 'trust extract-compat' * Workarounds for working on broken zfsonlinux.org [#68525] * Add --with-module-config parameter to the configure script [#68122] * Add support for removing stored PKCS#11 objects in trust module * Various debugging tweaks 0.19.3 (unstable) * Fix up problems with automake testing * Fix a bunch of memory leaks in newly refactored code * Don't use _GNU_SOURCE and the unportability it brings * Testing fixes 0.19.2 (unstable) * Add basic 'trust anchor' command to store a new anchor * Support for writing out trust token objects * Port to use CKA_PUBLIC_KEY_INFO and updated trust store spec * Add option to use freebl for hashing * Implement reloading of token data * Fix warnings and possible minor bugs higlighted by code scanners * Don't load configs in home directories when running setuid or setgid * Support treating ~/.config as $XDG_CONFIG_HOME * Use $XDG_DATA_HOME/pkcs11 as default user config directory * Use $TMPDIR instead of $TEMP while testing * Open files and fds with O_CLOEXEC * Abort initialization if a critical module fails to load * Don't use thread-unsafe functions: strerror, getpwuid * Fix p11_kit_space_strlen() result when empty string * Refactoring of where various components live * Build fixes 0.19.1 (unstable) * Refactor API to be able to handle managed modules * Deprecate much of old p11-kit API * Implement concept of managed modules * Make C_CloseAllSessions function work for multiple callers * New dependency on libffi * Fix possible threading problems reported by hellgrind * Add log-calls option * Mark p11_kit_message() as a stable function * Use our own unit testing framework 0.18.3 (stable) * Fix reinitialization of trust module [#65401] * Fix crash in trust module C_Initialize * Mac OS fixes [#57714] 0.18.2 (stable) * Build fixes [#64378 ...] 0.18.1 (stable) * Put the external tools in $libdir/p11-kit * Documentation build fixes 0.18.0 (stable) * Fix use of trust module with gcr and empathy [#62896] * Further tweaks to trust module date parsing * Fix unaligned memory reads [#62819] * Win32 fixes [#63062, #63046] * Debug and logging tweaks [#62874] * Other build fixes 0.17.5 (unstable) * Don't try to guess at overflowing time values on 32-bit systems [#62825] * Test fixes [#927394] 0.17.4 (unstable) * Check for duplicate certificates in a token, warn and discard [#62548] * Implement a proper index so we have decent load performance 0.17.3 (unstable) * Use descriptive labels for the trust module tokens [#62534] * Remove the temporary built in distrust objects * Make extracted output directories and files read-only [#61898] * Don't export unneccessary ABI * Build fixes [#62479] 0.17.2 (unstable) * Fix build on 32-bit linux * Fix several crashers 0.17.1 (unstable) * Support a p11-kit specific PKCS#11 attribute persistance format [#62156] * Use the SHA1 hash of SPKI as the CKA_ID in the trust module by default [#62329] * Refactor a trust builder which builds objects out of parsed data [#62329] * Combine trust policy when extracting certificates [#61497] * The extract --comment option adds comments to PEM bundles [#62029] * A new 'priority' config option for ordering modules [#61978] * Make each configured path its own trust module token [#61499] * Use --with-trust-paths to configure trust module [#62327] * Fix bug decoding some PEM files * Better debug output for trust module lookups * Work around bug in NSS when doing serial number lookups * Work around broken strndup() function in firefox * Fix the nickname for the distrusted attribute * Build fixes 0.16.4 (stable) * Display per command help again [#62153] * Don't always print tools debug output [#62152] 0.16.3 (stable) * When iterating don't skip tokens without the CKF_TOKEN_INITIALIZED flag * Hardcode some distrust records for NSS temporarily * Parse global options better in the p11-kit command * Better debugging 0.16.2 (stable) * Fix regression in 'p11-kit extract --purpose' option [#62009] * Documentation updates * Build fixes [#62001, ...] 0.16.1 (stable) * Don't break when cA field of BasicConstraints is missing [#61975] * Documentation fixes and updates * p11-kit extract-trust is a placeholder script now 0.16.0 (stable) * Update the pkcs11.h header for new mechanisms * Fix build and tests on mingw64 (ie: win32) * Relicense LGPL code to BSD license * Documentation tweaks * Pull translations from Transifex [#60792] * Build fixes [#61739, #60894, #61740] 0.15.2 (unstable) * Add German and Finish translations * Better define the libtasn1 dependency * Crasher and bug fixes * Build fixes 0.15.1 (unstable) * Fix some memory leaks * Add a location for packages to drop module configs * Documentation updates and fixes * Add command line tool manual page * Remove unused err() function and friends * Move more code into common/ directory and refactor * Add a system trust policy module * Refactor how the p11-kit command line tool works * Add p11-kit extract and extract-trust commands * Don't complain if we cannot access ~/.pkcs11/pkcs11.conf * Refuse to load the p11-kit-proxy.so as a registered module * Don't fail initialization if last initialized module fails 0.14 * Change default for user-config to merge * Always URI-encode the 'id' attribute in PKCS#11 URIs * Expect a .module extension on module configs * Windows compatibility fixes * Testing fixes * Build fixes 0.13 * Don't allow reading of PIN files larger than 4096 bytes * If a module is not marked as critical then ignore init failure * Use preconditions to check for input problems and out of memory * Add enable-in and disable-in options to module config * Fix the flags in pin.h * Use gcc extensions to check varargs during compile * Fix crasher when a duplicate module is present * Fix broken hashmap behavior * Testing fixes * Win32 build fixes * 'p11-kit -h' now works * Documentation fixes 0.12 * Build fix 0.11 * Remove automatic reinitialization of PKCS#11 after fork
2016-03-12Enable php-oauth1fhajny1-1/+2
2016-03-12Update security/php-oauth to 2.0.1.fhajny3-35/+8
2.0.1 * Fix multiple segfaults (kgovande, rlerdorf) 2.0.0 - PHP 7 Support - Bug 67658: configure does not detect missing pcre.h - Bug 67665: update fetch to accept 20X HTTP ranges - Bug 67883: check SERVER[REDIRECT_HTTP_AUTHORIZATION] for the Authorization header
2016-03-12Re-import security/php-oauth as security/php-oauth1 (for PHP<7).fhajny4-0/+55
OAuth is an authorization protocol built on top of HTTP which allows applications to securely access data without having to store usernames and passwords.
2016-03-10Ensure libss is built -static, the library is not installed resultingjperkin3-7/+10
in runtime failures which weren't previously detected due to a bug in check-shlibs. Bump PKGREVISION.
2016-03-10include <limits.h> for PATH_MAXtnn3-1/+31
2016-03-09Update p5-Crypt-ECB to 2.05:wiz2-7/+7
v2.05, 04.03.2016 - make Crypt:ECB work under perl-5.8.* again - some changes actually made in v2.00 haven't been mentioned in the changelog - add some more block ciphers to the test suite - minor changes in test.pl - minor documentation update
2016-03-09fix build on Linuxtnn1-1/+3
2016-03-08Update to 5.31ryoon2-8/+7
Changelog: Version 5.31, 2016.03.01, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 1.0.2g. https://www.openssl.org/news/secadv_20160301.txt * New features - Added logging the list of client CAs requested by the server. - Improved compatibility with the current OpenSSL 1.1.0-dev tree. * Bugfixes - Only reset the watchdog if some data was actually transferred. - A workaround implemented for the unexpected exceptfds set by select() on WinCE 6.0 (thx to Richard Kraemer).
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-30 21:42:21 +0000