summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2011-07-21recursive bump from gnome-vfs drop crypto dependency.obache3-6/+6
2011-07-16Regenerate checksum for patches.asau1-2/+2
2011-07-15disable AESNI support for now, until we have a method to tell whetherdrochner1-1/+2
the assembler supports the needed SSE commands, to allow building on NetBSD-5, in response to a report by Marc Baudoin to pkgsrc-users
2011-07-14propagate libtasn1 dependency, should fix seahorse build failuredrochner1-1/+2
reported by Ryo ONODERA per PR pkg/45144
2011-07-14Fixes PKGCONFIG_OVERRIDE settings:obache1-5/+4
* No need to prefix with ${WRKSRC}. * It must not be overwritten multiple time, or only last one will be activate. * library/gnome-keyring part is now in separate libgnome-keyring package. Bump PKGREVISION.
2011-07-14Re-add entries for gcrypt.tar.bz2 which neede by idea PKG_OPTIONS.taca1-1/+4
2011-07-13Changes 1.5.0:adam12-53/+88
* New function gcry_kdf_derive implementing OpenPGP S2K algorithms and PBKDF2. * Support for WindowsCE. * Support for ECDH. * Support for OAEP and PSS methods as described by RFC-3447. * Fixed PKCS v1.5 code to always return the leading zero. * New format specifiers "%M" and "%u" for gcry_sexp_build. * Support opaque MPIs with "%m" and "%M" in gcry_sexp_build. * New functions gcry_pk_get_curve and gcry_pk_get_param to map ECC parameters to a curve name and to retrieve parameter values. * gcry_mpi_cmp applied to opaque values has a defined semantic now. * Uses the Intel AES-NI instructions if available. * The use of the deprecated Alternative Public Key Interface (gcry_ac_*) will now print compile time warnings. * The module register subsystem has been deprecated. This subsystem is not flexible enough and would always require ABI changes to extend the internal interfaces. It will eventually be removed. Please contact us on the gcrypt-devel mailing list to discuss whether you really need this feature or how it can be replaced by an internal plugin mechanism. * CTR mode may now be used with data chunks of arbitrary length.
2011-07-11update to 2.12.7drochner4-12/+14
changes: -bugfixes -minor feature additions pkgsrc change: since the pkg was changed to build against "nettle" instead of libgcrypt (whether this was a good idea or not...), the latter isn't needed anymore, so remove the stale dependency This can cause build breakage -- in this case addition of a local dependency should restore the old state. (This dependency is technically unnecessary often, but the assumption that gnutls needs libgcrypt is sometimes hardwired in configure scripts and/or code.)
2011-07-11Update to 4.39ryoon5-20/+20
Version 4.39, 2011.07.06, urgency: LOW: New features New Win32 installer module to build self-signed stunnel.pem. Added configuration file editing with Windows GUI. Added log file reopening file editing with Windows GUI. It might be useful to also implement log file rotation. Improved configuration file reload with Windows GUI. Version 4.38, 2011.06.28, urgency: MEDIUM: New features Server-side SNI implemented (RFC 3546 section 3.1) with a new service-level option "nsi". "socket" option also accepts "yes" and "no" for flags. Nagle's algorithm is now disabled by default for improved interactivity. Bugfixes A compilation fix was added for OpenSSL version < 1.0.0. Signal pipe set to non-blocking mode. This bug caused hangs of stunnel features based on signals, e.g. local mode, FORK threading, or configuration file reload on Unix. Win32 platform was not affected. Version 4.37, 2011.06.17, urgency: MEDIUM: New features Client-side SNI implemented (RFC 3546 section 3.1). Default "ciphers" changed from the OpenSSL default to a more secure and faster "RC4-MD5:HIGH:!aNULL:!SSLv2". A paranoid (and usually slower) setting would be "HIGH:!aNULL:!SSLv2". Recommended "options = NO_SSLv2" added to the sample stunnel.conf file. Default client method upgraded from SSLv3 to TLSv1. To connect servers without TLS support use "sslVersion = SSLv3" option. Improved --enable-fips and --disable-fips ./configure option handling. On startup stunnel now compares the compiled version of OpenSSL against the running version of OpenSSL. A warning is logged on mismatch. Bugfixes Non-blocking socket handling in local mode fixed (Debian bug #626856). UCONTEXT threading mode fixed. Removed the use of gcc Thread-Local Storage for improved portability. va_copy macro defined for platforms that do not have it. Fixed "local" option parsing on IPv4 systems. Solaris compilation fix (redefinition of "STR"). Version 4.36, 2011.05.03, urgency: LOW: New features Updated Win32 DLLs for OpenSSL 1.0.0d. Dynamic memory management for strings manipulation: no more static STRLEN limit, lower stack footprint. Strict public key comparison added for "verify = 3" certificate checking mode (thx to Philipp Hartwig). Backlog parameter of listen(2) changed from 5 to SOMAXCONN: improved behavior on heavy load. Example tools/stunnel.service file added for systemd service manager. Bugfixes Missing pthread_attr_destroy() added to fix memory leak (thx to Paul Allex and Peter Pentchev). Fixed the incorrect way of setting FD_CLOEXEC flag. Fixed --enable-libwrap option of ./configure script. /opt/local added to OpenSSL search path for MacPorts compatibility. Workaround implemented for signal handling on MacOS X. A trivial bug fixed in the stunnel.init script. Retry implemented on EAI_AGAIN error returned by resolver calls. Version 4.35, 2011.02.05, urgency: LOW: New features Updated Win32 DLLs for OpenSSL 1.0.0c. Transparent source (non-local bind) added for FreeBSD 8.x. Transparent destination ("transparent = destination") added for Linux. Bugfixes Fixed reload of FIPS-enabled stunnel. Compiler options are now auto-detected by ./configure script in order to support obsolete versions of gcc. Async-signal-unsafe s_log() removed from SIGTERM/SIGQUIT/SIGINT handler. CLOEXEC file descriptor leaks fixed on Linux >= 2.6.28 with glibc >= 2.10. Irreparable race condition leaks remain on other Unix platforms. This issue may have security implications on some deployments: http://udrepper.livejournal.com/20407.html Directory lib64 included in the OpenSSL library search path. Windows CE compilation fixes (thx to Pierre Delaage). Deprecated RSA_generate_key() replaced with RSA_generate_key_ex(). Domain name changes (courtesy of Bri Hatch) http://stunnel.mirt.net/ --> http://www.stunnel.org/ ftp://stunnel.mirt.net/ --> http://ftp.stunnel.org/ stunnel.mirt.net::stunnel --> rsync.stunnel.org::stunnel stunnel-users@mirt.net --> stunnel-users@stunnel.org stunnel-announce@mirt.net --> stunnel-announce@stunnel.org Version 4.34, 2010.09.19, urgency: LOW: New features Updated Win32 DLLs for OpenSSL 1.0.0a. Updated Win32 DLLs for zlib 1.2.5. Updated automake to version 1.11.1 Updated libtool to version 2.2.6b Added ECC support with a new service-level "curve" option. DH support is now enabled by default. Added support for OpenSSL builds with some algorithms disabled. ./configure modified to support cross-compilation. Sample stunnel.init updated based on Debian init script. Bugfixes Implemented fixes in user interface to enter engine PIN. Fixed a transfer() loop issue on socket errors. Fixed missing WIN32 taskbar icon while displaying a global option error.
2011-07-11Update ruby-oauth to 0.4.5.obache3-11/+10
=== 0.4.5 2011-06-25 * Add explicit require for rsa/sha1 (Juris Galang) * Use webmock to mock all http-requests in tests (Adrian Feldman) * Add gemtest support (Adrian Feldman) * Fix POST Requests with Typhoeus proxy (niedhui) * Mention Typhoeus require in the README (Kim Ahlström) * Fix incorrect hardcoded port (Ian Taylor) * Use Net::HTTPGenericRequest (Jakub Kuźma)
2011-07-11-depend on libgcrypt explicitelydrochner2-3/+3
(gnutls used to pull it in for us, but this will be cleaned up) -libgnutls-config isn't needed (uses pkg-config)
2011-07-11+ ruby-twitter_oauthobache1-1/+2
2011-07-11Import ruby-twitter_oauth-0.4.3 as security/ruby-twitter_oauth.obache4-0/+45
twitter_oauth is a Ruby client for the Twitter API using OAuth.
2011-07-08depend on libgcrypt explicitelydrochner3-2/+19
(gnutls used to pull it in for us, but this will be cleaned up) also remove an assumption about time_t size which fails on NetBSD-current
2011-07-08Changes 1.8.4:adam3-40/+18
This is primarily a bugfix release. Fix vulnerabilities: * KDC uninitialized pointer crash [MITKRB5-SA-2010-006 CVE-2010-1322] * kpropd denial of service [MITKRB5-SA-2011-001 CVE-2010-4022] * KDC denial of service attacks [MITKRB5-SA-2011-002 CVE-2011-0281 CVE-2011-0282 CVE-2011-0283] * KDC double-free when PKINIT enabled [MITKRB5-SA-2011-003 CVE-2011-0284] * kadmind frees invalid pointer [MITKRB5-SA-2011-004 CVE-2011-0285] Interoperability: * Correctly encrypt GSSAPI forwarded credentials using the session key, not a subkey. * Set NT-SRV-INST on TGS principal names as expected by some Windows Server Domain Controllers. * Don't reject AP-REQ messages if their PAC doesn't validate; suppress the PAC instead. * Correctly validate HMAC-MD5 checksums that use DES keys
2011-07-08Changes 1.4:adam15-333/+463
New features * Support for reading MIT database file directly * KCM is polished up and now used in production * NTLM first class citizen, credentials stored in KCM * Table driven ASN.1 compiler, smaller!, not enabled by default * Native Windows client support Notes * Disabled write support NDBM hdb backend (read still in there) since it can't handle large records, please migrate to a diffrent backend (like BDB4) Changes 1.3.3: Bug fixes * Check the GSS-API checksum exists before trying to use it [CVE-2010-1321] * Check NULL pointers before dereference them [kdc] Changes 1.3.2: Bug fixes * Don't mix length when clearing hmac (could memset too much) * More paranoid underrun checking when decrypting packets * Check the password change requests and refuse to answer empty packets * Build on OpenSolaris * Renumber AD-SIGNED-TICKET since it was stolen from US * Don't cache /dev/*random file descriptor, it doesn't get unloaded * Make C++ safe * Misc warnings
2011-07-08Changes 0.97.1:adam5-17/+17
This is a bugfix release recommended for all users. Please refer to the ChangeLog file for details.
2011-07-05Add fix for MITKRB5-SA-2011-005 (ftpd fails to setegid from daemon)tez2-2/+18
2011-07-05Fix broken build. Needs explicit -lgcrypt. Add comment to patch-aa.dholland3-3/+21
2011-07-04Correct the fix for http://secunia.com/advisories/44572/tez3-9/+10
See the thread here: http://www.mail-archive.com/openssl-dev@openssl.org/msg29283.html
2011-06-23* set LICENSE=gnu-gpl-v2 # or laterobache1-2/+3
* Allow to build with builtin libevent, because just libevent>=1.0 is required, and builtin libevent version detection was added quite a few years ago. No bump PKGREVISION, because it is impossible to build with libevent-2 from pkgsrc.
2011-06-20add patch from upstream to fix a sign extension problem whichdrochner3-2/+19
breaks blowfish password hashes for non-ASCII characters bump PKGREV
2011-06-19Update sudo package to 1.7.6.2 (1.7.6p2).taca6-36/+37
What's new in Sudo 1.7.6p2 * Two-character CIDR-style IPv4 netmasks are now matched correctly in the sudoers file. * A build error with MIT Kerberos V has been resolved. What's new in Sudo 1.7.6p1 * A non-existent includedir is now treated the same as an empty directory and not reported as an error. * Removed extraneous parens in LDAP filter when sudoers_search_filter is enabled that can cause an LDAP search error.
2011-06-19Add and enable ruby-bcrypt.taca1-1/+2
2011-06-19Importing ruby-bcrypt version 2.1.4 package.taca4-0/+67
bcrypt() is a sophisticated and secure hash algorithm designed by The OpenBSD project for hashing passwords. bcrypt-ruby provides a simple, humane wrapper for safely handling passwords. = bcrypt-ruby An easy way to keep your users' passwords secure. * http://bcrypt-ruby.rubyforge.org/ * http://github.com/codahale/bcrypt-ruby/tree/master == Why you should use bcrypt If you store user passwords in the clear, then an attacker who steals a copy of your database has a giant list of emails and passwords. Some of your users will only have one password -- for their email account, for their banking account, for your application. A simple hack could escalate into massive identity theft. It's your responsibility as a web developer to make your web application secure -- blaming your users for not being security experts is not a professional response to risk. bcrypt allows you to easily harden your application against these kinds of attacks.
2011-06-14Support user-destdir.uebayasi1-30/+35
2011-06-10recursive bump from icu shlib major bump.obache1-2/+2
2011-06-10add a hint for gnupg2 users (as claws-mail with the s/mime plugin)drochner1-1/+10
2011-06-10recursive bump from textproc/icu shlib major bump.obache6-9/+12
2011-06-10Update ruby-roauth to 0.0.7.obache3-8/+7
bug fixes.
2011-06-01Changes 1.6.1:adam4-10/+12
* build: Demand gettext >= 0.18.1 in order to get newer M4 files. The old M4 files associated with 0.17 caused problems on Solaris, which will hopefully be fixed with this. * doc: Typo fix in autoconf snippet. * i18n: Updated translations.
2011-06-01Fix building with Clangadam2-1/+17
2011-05-31Add protection against ECDSA timing attacks as mentioned in the papertez3-3/+31
by Billy Bob Brumley and Nicola Tuveri, see: http://eprint.iacr.org/2011/232.pdf [Billy Bob Brumley and Nicola Tuveri] (patch confirmed in upstream cvs)
2011-05-28DESCR_SRC now contains full paths to DESCR filescheusov1-2/+2
2011-05-28add heirloom-su, oked by sponsorscheusov1-1/+2
2011-05-28heirloom partcheusov3-0/+21
2011-05-27Bump PKGREVISION for dependency removal.wiz1-2/+2
2011-05-27libgnome-keyring 2.32.0 does not depend on eggdbus anymore, according tohans2-4/+2
http://mail.gnome.org/archives/gnome-announce-list/2010-September/msg00101.html
2011-05-27Added support for new 2048 bit FINEID cards.kivinen4-3/+72
2011-05-26* LICENSE=gnu-gpl-v2 # or laterobache3-12/+15
* honor PKGMANDIR * add user-destdir installation support * use ${PERL5} as shebang, not /usr/bin/env. Bump PKGREVISION.
2011-05-25add patch from upstream to make network connections (to fetch CRLs)drochner3-3/+87
non-blocking. Blocking can be considered a DOS problem because other requests are not served in that time. (SA44680, no CVE entry) bump PKGREV
2011-05-20Changes 0.12:adam2-9/+8
* OpenSSL/crypto/x509.c: Add get_extension_count and get_extension to the X509 type, allowing read access to certificate extensions. * OpenSSL/crypto/x509ext.c: Add get_short_name and get_data to the X509Extension type, allowing read access to the contents of an extension. * OpenSSL/ssl/ssl.c: Expose a number of symbolic constants for values passed to the connection "info" callback. * OpenSSL/ssl/connection.py: Add support for new-style buffers (primarily memoryviews) to Connection.send and Connection.sendall.
2011-05-19make this build again on NetBSD-currentdrochner10-19/+150
2011-05-18update to 1.2.18drochner2-7/+6
change: fixes a serious crasher
2011-05-18this pkg only installs binaries -- no need to propagate librarydrochner1-6/+1
dependencies
2011-05-17Don't always try to create ecdsa key which depends on OpenSSL's version.taca2-4/+19
Bump PKGREVISION.
2011-05-16Maintenance of openssh pacakge:taca2-4/+21
1. Add support for check and create ECDSA host key for SSH protocol version 2. 2. Disable use of strnvis(3) on NetBSD. NetBSD current after 2011/03/12 has strnvis(3), but it has different argument from OpenBSD (and other system). Bump PKGREVISION.
2011-05-15Update security/ruby-net-ssh-gateway to version 1.1.0gls2-6/+6
Upstream changes: 1.1.0 / 30 Apr 2011 * Fix for sporadicly stalled SSH connections in Ruby 1.9 [Mat Trudel] * Decrease wait time within Net::SSH session loop [Grant Hutchins, Michael Schubert]
2011-05-15Update security/ruby-net-ssh to version 2.1.4.gls2-6/+6
Upstream changes: 2.1.4 / 3 Apr 2011 * Add ConnectionTimeout exception class. [Joel Watson] See: https://github.com/net-ssh/net-ssh-multi/pull/1 2.1.3 / 2 Mar 2011 * Call to transport.closed should be transport.close [Woon Jung] 2.1.2 / 1 Mar 2011 * Fix for Net::SSH Continues to attempt authentication when notified it is not allowed [Eric Hodel] (see: http://net-ssh.lighthouseapp.com/projects/36253-net-ssh/tickets/26) * Fix for transport won't be closed if authentication fails [Patrick Marchi] 2.1 / 19 Jan 2011 * Support "IdentitiesOnly" directive (LH-24) [Musy Bite, Edmund Haselwanter] * Speeding up the Loggable module (LH-23) [robbebob] 2.0.24 / 14 Jan 2011 * Fix for process code to correctly wait until remote_id is set before sending any output, including eof. [Daniel Pittman, Markus Roberts] * Fix circular require warning in Ruby 1.9.2 [Gavin Brock]
2011-05-15Finish move of tarsnap from security to sysutils.wiz5-47/+1
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-29 17:50:53 +0000