summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2015-02-04Update ruby-net-scp to 1.2.1.taca3-7/+8
=== 1.2.1 / 30 Apr 2014 * Resign gem with new pubkey === 1.2.0 / 11 Apr 2014 * Get the error string during download [jkeiser]
2015-02-04Update ruby-net-ssh to 2.9.2.taca3-8/+12
=== 2.9.2-rc3 * Remove advertised algorithms that were not working (curve25519-sha256@libssh.org) [mfazekas] === 2.9.2-rc2 * number_of_password_prompts is now accepted as ssh option, by setting it 0 net-ssh will not ask for password for password auth as with previous versions [mfazekas] === 2.9.2-rc1 * Documentation fixes and refactoring to keepalive [detiber, mfazekas] === 2.9.2-beta * Remove advertised algorithms that were not working (ssh-rsa-cert-* *ed25519 acm*-gcm@openssh.com) [mfazekas] * Unkown algorithms now ignored instead of failed [mfazekas] * Asks for password with password auth (up to number_of_password_prompts) [mfazekas] * Removed warnings [amatsuda] === 2.9.1 / 13 May 2014 * Fix for unknown response from agent on Windows with 64-bit PuTTY [chrahunt] * Support negative patterns in host lookup from the SSH config file [nirvdrum] === 2.9.0 / 30 Apr 2014 * New ciphers [chr4] * Added host keys: ssh-rsa-cert-v01@openssh.com ssh-rsa-cert-v00@openssh.com ssh-ed25519-cert-v01@openssh.com ssh-ed25519 * Added HMACs: hmac-sha2-512-etm@openssh.com hmac-sha2-256-etm@openssh.com umac-128-etm@openssh.com * Added Kex: aes256-gcm@openssh.com aes128-gcm@openssh.com curve25519-sha256@libssh.org * Added private key support for id_ed25519 * IdentiesOnly will not disable ssh_agent - fixes #148 and new fix for #137 [mfazekas] * Ignore errors during ssh agent negotiation [simonswine, jasiek] * Added an optional "options" argument to test socket open method [jefmathiot] * Added gem signing (again) with new cert [delano] === 2.8.1 / 19 Feb 2014 * Correct location of global known_hosts files [mfischer-zd] * Fix for password authentication [blackpond, zachlipton, delano]
2015-02-04Update ruby-bcrypt to 3.1.10.taca2-6/+6
3.1.8 Oct 23 2014 - Add support for Ruby 2.1 in compiled Windows binaries [GH #102] 3.1.9 Oct 23 2014 - Rebuild corrupt binaries 3.1.10 Jan 28 2015 - Fix issue with dumping a BCrypt::Password instance to YAML in Ruby 2.2 [GH #107 by @mattwildig]
2015-02-04Update to 2.012. Depend on p5-Mozilla-CA.wiz2-6/+7
2.012 2014/02/02 - fix t/ocsp.t in case no HTTP::Tiny is installed 2.011 2014/02/01 - fix t/ocsp.t - don't count on revoked.grc.com using OCSP stapling #101855 - added option 'purpose' to Utils::CERT_create to get better control of the certificates purpose. Default is 'server,client' for non-CA (contrary to only 'server' before) - removed RC4 from default cipher suites on the server site https://github.com/noxxi/p5-io-socket-ssl/issues/22 - refactoring of some tests using Test::More thanks to Sweet-kid and the 2015 Pull Request Challenge
2015-02-03Update netpgpverify, and libnetpgpverify, to 20150204agc1-2/+2
+ dump the huge output to /dev/null so that we can see what's happening with the other tests in testit.sh + fix from jperkin@, don't try to be clever when selecting the only key id in a keyring + add a test for single key (non-ssh) pubring
2015-02-03Update netpgpverify, and libnetpgpverify, to 20150204agc6-7/+7
+ dump the huge output in testing script to /dev/null so that we can see what's happening with the other tests in testit.sh + fix from jperkin@, don't try to be clever when selecting the only key id in a keyring + add a test for single key (non-ssh) pubring
2015-02-03Update netpgpverify, and libnetpgpverify, to 20150203agc6-24/+31
+ portability fixes to make netpgpverify build on freebsd 10.1 with WARNS=5 + fixed an oversight in the testit.sh script
2015-02-01Update to 4.1:wiz2-7/+6
4.1 --- * Added preliminary support for loading keyring backends through ``setuptools entry points``, specifically "keyring backends".
2015-02-01Update to 1.18:wiz3-8/+12
Noteworthy changes in version 1.18 (2015-01-26) [C14/A14/R0] ----------------------------------------------- * New translations for Hungarian, Portuguese, Russian, and traditional Chinese. Updated other translations. * New error codes. * Interface changes relative to the 1.17 release: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ GPG_ERR_FORBIDDEN NEW. GPG_ERR_OBJ_TERM_STATE NEW. GPG_ERR_REQUEST_TOO_SHORT NEW. GPG_ERR_REQUEST_TOO_LONG NEW. GPG_ERR_LEGACY_KEY NEW.
2015-02-01Revert "Define and use MASTER_SITE_OPENBSD.",obache1-2/+7
proposed/discussed is required for such changes.
2015-01-31allow the keyring to be set on the command line in the chk.sh scriptagc1-2/+4
this syncs with sources under src/crypto
2015-01-30Missed file in previous - sync with reality...agc1-13/+9
2015-01-30Update to version 20150115.agc9-18/+171
This version includes support for the '-c dump' command, which dumps the contents of all PGP packets to stdout. Note that since we're verifying, no private keys are involved.
2015-01-27Fix typo in previous.jperkin1-2/+2
2015-01-27Ensure we call the full path to the script. Bump PKGREVISION.jperkin2-5/+5
2015-01-26On Darwin define BIND_8_COMPAT to resolve build issue as dsniff utilises thesevan1-1/+5
BIND8 API, not the v9 API. Closes PR pkg/39062 Reviewed by wiz@
2015-01-25For clang, don't use the rotate inline asm, but expect the compiler tojoerg2-1/+27
generate optimal code.
2015-01-25Update to 1.68:wiz2-6/+6
1.68 2015-01-24 Fixed a problem on OSX when macports openssl 1.x is installed: headers from macport were found but older OSX openssl libraries were linked, resulting in "Symbol not found: _EVP_MD_do_all_sorted". Added notes about runtime error "no OPENSSL_Applink", when calling Net::SSLeay::P_PKCS12_load_file.
2015-01-23Not MAKE_JOBS_SAFE.joerg1-1/+4
2015-01-23simplify MASTER_SITES subdirectory.obache1-2/+2
2015-01-20Revbump associated with update of lang/ocaml.jaapb5-8/+10
2015-01-18Update to 2.010:wiz2-6/+6
2.010 2014/01/14 - new options SSL_client_ca_file and SSL_client_ca to let the server send the list of acceptable CAs for the client certificate. - t/protocol_version.t - fix in case SSLv3 is not supported in Net::SSLeay. RT#101485, thanks to TEAM.
2015-01-18Update to 1.67:wiz2-6/+6
1.67 2015-01-17 Improvements to inc/Module/Install/PRIVATE/Net/SSLeay.pm to handle the case whe there are muliple OPENSSLs installed. Patch from HBRAND Fixed a documentation error in get_peer_cert_chain, reported by tejas. Fixed a problem with building on Windows that prevented correct OpenSSL directory detection with version 1.0.1j as delivered with Shining Light OpenSSL. Fixed a problem with building on Windows that prevented finding MT or MD versions of SSL libraries. Updated doc in README.Win32 to build with Microsoft Visual Studio 2010 Express. Added Windows crypt32 library to Windows linking as some compilers/platforms seem to require it and it is innocuous otherwise. For Steve Hay. Fixed a failure in t/external/20_cert_chain.t where some platforms do not have HTTPS in /etc/services. Reported and patched by Gisle Aas. Recent 1.0.2 betas have dropped the SSLv3_method function. This patch leaves out the function on newer versions, much the same as the SSLv2 deprecation is handled. Patch from Tom Molesworth. Fix the ALPN test, which was incorrectly failing on OpenSSL due to the LibreSSL check (earlier versions bailed out before that line).Patch from Tom Molesworth.
2015-01-18Update to 0.7.2:wiz2-7/+6
0.7.2 - 2015-01-16 ~~~~~~~~~~~~~~~~~~ * Updated Windows wheels to be compiled against OpenSSL 1.0.1l. * ``enum34`` is no longer installed on Python 3.4, where it is included in the standard library. * Added a new function to the OpenSSL bindings to support additional functionality in pyOpenSSL.
2015-01-17Fix startup script. Bump PKGREVISION. From ISIHARA Takanori.wiz2-31/+4
(Ooops, what happened here.)
2015-01-17Define and use MASTER_SITE_OPENBSD.obache1-6/+2
2015-01-17Remve "Don't delete the last entry" from MASTER_SITES.obache1-5/+2
It's not available. ftp://ftp.belnet.be/pub/OpenBSD/OpenSSH/portable/ (capitalize openbsd) is availabe, but it's a mirror, not the special old distfile holder. Moreover, mirrors have good enough old versions, and "old" subdirectory have much old distfiles.
2015-01-17Use sh not C comments in sh scripts.gdt2-7/+7
From Matthias Ferdinand on pkgsrc-users.
2015-01-16Update to 1.0.1:wiz2-6/+6
* Version 1.0.1 - DLL_EXPORT was renamed SODIUM_DLL_EXPORT in order to avoid collisions with similar macros defined by other libraries. - sodium_bin2hex() is now constant-time. - crypto_secretbox_detached() now supports overlapping input and output regions. - NaCl's donna_c64 implementation of curve25519 was reading an extra byte past the end of the buffer containing the base point. This has been fixed.
2015-01-15Fix executable name in gpgkey2ssh tool.wiz3-2/+19
From ISIHARA Takanori in PR 49576. Bump PKGREVISION.
2015-01-15Add rc.d script, from ISIHARA Takanori in PR 49574.wiz3-5/+49
Bump PKGREVISION.
2015-01-15Build pinentry-tty by default. From ISIHARA Takanori in PR 49573.wiz2-2/+6
Bump PKGREVISION.
2015-01-14Update to 2.009:wiz2-6/+6
2.009 2014/01/12 - remove util/analyze.pl. This tool is now together with other SSL tools in https://github.com/noxxi/p5-ssl-tools - added ALPN support (needs OpenSSL1.02, Net::SSLeay 1.56+) thanks to TEAM, RT#101452
2015-01-14Update to 2.54:wiz2-7/+6
2015-01-12 Gisle Aas <gisle@ActiveState.com> Release 2.54 David Mitchell: silence some compiler warnings Jonathan Hall: Add ->context() feature Steve Hay: Sync with blead bulk88: const the vtable zefram: 5.6 threads test fix
2015-01-11Convert to egg.mk. Rename additionally installed file so that multiplewiz3-4/+16
python versions' packages don't conflict. Add ALTERNATIVES file. Bump PKGREVISION.
2015-01-11Update to 5.95wen2-6/+6
Upstream changes: 5.95 Sat Jan 10 12:15:36 MST 2015 - modified the bit-ordering test (ref. t/bitorder.t) -- supplied directory-change preamble for CORE builds 5.94 Sat Jan 10 00:45:28 MST 2015 - added support for threaded builds -- PERL_GET_NO_CONTEXT, pTHX_, aTHX_, etc. -- employed 'const' storage class where possible -- ref. rt.cpan.org #101260 - simplified shabits() routine (bitwise input buffering) -- slightly less efficient but easier to understand -- ref. rt.cpan.org #101344 - minor documentation tweaks and additions
2015-01-10Simplify PKGNAME.wiz1-3/+4
2015-01-09security/dirmngr: compatibility with libgcrypt>=1.6.0rumko3-7/+23
Before 1.6.0 version, libgcrypt called pth_init() on it's own, in later version dirmngr has to be the one to call pth_init(). With this dirmngr actually works (does not seg fault immediately). Since it's a runtime problem, PKGREVISION bumped. OK@ wiz
2015-01-08Update to 1.0.1k:wiz3-22/+6
Changes between 1.0.1j and 1.0.1k [8 Jan 2015] *) Fix DTLS segmentation fault in dtls1_get_record. A carefully crafted DTLS message can cause a segmentation fault in OpenSSL due to a NULL pointer dereference. This could lead to a Denial Of Service attack. Thanks to Markus Stenberg of Cisco Systems, Inc. for reporting this issue. (CVE-2014-3571) [Steve Henson] *) Fix DTLS memory leak in dtls1_buffer_record. A memory leak can occur in the dtls1_buffer_record function under certain conditions. In particular this could occur if an attacker sent repeated DTLS records with the same sequence number but for the next epoch. The memory leak could be exploited by an attacker in a Denial of Service attack through memory exhaustion. Thanks to Chris Mueller for reporting this issue. (CVE-2015-0206) [Matt Caswell] *) Fix issue where no-ssl3 configuration sets method to NULL. When openssl is built with the no-ssl3 option and a SSL v3 ClientHello is received the ssl method would be set to NULL which could later result in a NULL pointer dereference. Thanks to Frank Schmirler for reporting this issue. (CVE-2014-3569) [Kurt Roeckx] *) Abort handshake if server key exchange message is omitted for ephemeral ECDH ciphersuites. Thanks to Karthikeyan Bhargavan of the PROSECCO team at INRIA for reporting this issue. (CVE-2014-3572) [Steve Henson] *) Remove non-export ephemeral RSA code on client and server. This code violated the TLS standard by allowing the use of temporary RSA keys in non-export ciphersuites and could be used by a server to effectively downgrade the RSA key length used to a value smaller than the server certificate. Thanks for Karthikeyan Bhargavan of the PROSECCO team at INRIA or reporting this issue. (CVE-2015-0204) [Steve Henson] *) Fixed issue where DH client certificates are accepted without verification. An OpenSSL server will accept a DH certificate for client authentication without the certificate verify message. This effectively allows a client to authenticate without the use of a private key. This only affects servers which trust a client certificate authority which issues certificates containing DH keys: these are extremely rare and hardly ever encountered. Thanks for Karthikeyan Bhargavan of the PROSECCO team at INRIA or reporting this issue. (CVE-2015-0205) [Steve Henson] *) Ensure that the session ID context of an SSL is updated when its SSL_CTX is updated via SSL_set_SSL_CTX. The session ID context is typically set from the parent SSL_CTX, and can vary with the CTX. [Adam Langley] *) Fix various certificate fingerprint issues. By using non-DER or invalid encodings outside the signed portion of a certificate the fingerprint can be changed without breaking the signature. Although no details of the signed portion of the certificate can be changed this can cause problems with some applications: e.g. those using the certificate fingerprint for blacklists. 1. Reject signatures with non zero unused bits. If the BIT STRING containing the signature has non zero unused bits reject the signature. All current signature algorithms require zero unused bits. 2. Check certificate algorithm consistency. Check the AlgorithmIdentifier inside TBS matches the one in the certificate signature. NB: this will result in signature failure errors for some broken certificates. Thanks to Konrad Kraszewski from Google for reporting this issue. 3. Check DSA/ECDSA signatures use DER. Reencode DSA/ECDSA signatures and compare with the original received signature. Return an error if there is a mismatch. This will reject various cases including garbage after signature (thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS program for discovering this case) and use of BER or invalid ASN.1 INTEGERs (negative or with leading zeroes). Further analysis was conducted and fixes were developed by Stephen Henson of the OpenSSL core team. (CVE-2014-8275) [Steve Henson] *) Correct Bignum squaring. Bignum squaring (BN_sqr) may produce incorrect results on some platforms, including x86_64. This bug occurs at random with a very low probability, and is not known to be exploitable in any way, though its exact impact is difficult to determine. Thanks to Pieter Wuille (Blockstream) who reported this issue and also suggested an initial fix. Further analysis was conducted by the OpenSSL development team and Adam Langley of Google. The final fix was developed by Andy Polyakov of the OpenSSL core team. (CVE-2014-3570) [Andy Polyakov] *) Do not resume sessions on the server if the negotiated protocol version does not match the session's version. Resuming with a different version, while not strictly forbidden by the RFC, is of questionable sanity and breaks all known clients. [David Benjamin, Emilia Käsper] *) Tighten handling of the ChangeCipherSpec (CCS) message: reject early CCS messages during renegotiation. (Note that because renegotiation is encrypted, this early CCS was not exploitable.) [Emilia Käsper] *) Tighten client-side session ticket handling during renegotiation: ensure that the client only accepts a session ticket if the server sends the extension anew in the ServerHello. Previously, a TLS client would reuse the old extension state and thus accept a session ticket if one was announced in the initial ServerHello. Similarly, ensure that the client requires a session ticket if one was advertised in the ServerHello. Previously, a TLS client would ignore a missing NewSessionTicket message. [Emilia Käsper]
2015-01-07Revert previous, already fixed.wiz1-2/+1
2015-01-06Needs py-enum34.joerg1-1/+3
2015-01-05Replace patch-ab with upstream version, seewiz4-52/+61
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commitdiff;h=817472358a093438e802380caecf7139406400cf;hp=8c5eee51d9a25b143e41ffb7ff4a6b2a29b82d83 Bump PKGREVISION.
2015-01-05update to 0.15.2drochner3-8/+20
There is no useful changelog, but it makes the client work again a recent OpenSSH server (6.7p1-hpn14v5) again. Tested with "duplicity".
2015-01-05Forgot to add / commit options.mkimil2-2/+19
2015-01-05Comment out options.mk until imil has time to add it.wiz1-2/+2
2015-01-05Depend on py-enum34 if not building for python-3.4.wiz1-1/+7
2015-01-04Update to 1.1.12:wiz2-6/+6
Allow option to set subject.
2015-01-04At long last, remove KerberosIV support. Just use ROT13 if you need ajoerg29-911/+1
similar encryption strength.
2015-01-04Add missing py-asn1 dependency causing build breakage.wiz1-1/+2
XXX: No idea why I missed that when updating the package.
2015-01-04Use BROKEN_ON_PLATFORM here; see PR 42039.dholland1-2/+2
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-08 15:36:02 +0000