summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2012-01-12Version 1.10.5pettai2-6/+6
* Build fixes from Linus Nordberg and Arno Hautala. * Update gnulib files.
2012-01-12Update p5-Mozilla-CA to 20111025.hiramatsu2-6/+6
Change from previous: --------------------- 20111025 - Do not add CA's only trusted for email and/or code signing (RT#70967) (if you need that, please let us know and we can see about putting it in as an option)
2012-01-11+racoon2drochner1-1/+2
2012-01-11add the latest snapshot of racoon2 (IKEv2 daemon), from John R. Shannondrochner10-0/+333
(just added DESTDIR support)
2012-01-09Re-enable PAM support, as it works fine provided one does not mix multiplemanu3-12/+5
versions of libcrypto in sshd. This can happen if OpenSSH is linked with pkgsrc's OpenSSL and if using nss_ldap, which pulls base-system OpenSSL through kerberos libraries. One needs to disable the krb5 of nss_ldap in order to fix that.
2012-01-08Uses <sys/vnode.h> -- mark BSD-only and HPUX-only.shattered1-1/+3
2012-01-08Add missing devel/ncurses buildlink.sbd4-8/+12
Bump PKGREVISION
2012-01-06Update openssl pacakge to 0.9.8s.taca4-67/+6
OpenSSL CHANGES _______________ Changes between 0.9.8r and 0.9.8s [4 Jan 2012] *) Nadhem Alfardan and Kenny Paterson have discovered an extension of the Vaudenay padding oracle attack on CBC mode encryption which enables an efficient plaintext recovery attack against the OpenSSL implementation of DTLS. Their attack exploits timing differences arising during decryption processing. A research paper describing this attack can be found at: http://www.isg.rhul.ac.uk/~kp/dtls.pdf Thanks go to Nadhem Alfardan and Kenny Paterson of the Information Security Group at Royal Holloway, University of London (www.isg.rhul.ac.uk) for discovering this flaw and to Robin Seggelmann <seggelmann@fh-muenster.de> and Michael Tuexen <tuexen@fh-muenster.de> for preparing the fix. (CVE-2011-4108) [Robin Seggelmann, Michael Tuexen] *) Stop policy check failure freeing same buffer twice. (CVE-2011-4109) [Ben Laurie, Kasper <ekasper@google.com>] *) Clear bytes used for block padding of SSL 3.0 records. (CVE-2011-4576) [Adam Langley (Google)] *) Only allow one SGC handshake restart for SSL/TLS. (CVE-2011-4619) [Adam Langley (Google)] *) Prevent malformed RFC3779 data triggering an assertion failure. Thanks to Andrew Chi, BBN Technologies, for discovering the flaw and Rob Austein <sra@hactrn.net> for fixing it. (CVE-2011-4577) [Rob Austein <sra@hactrn.net>] *) Fix ssl_ciph.c set-up race. [Adam Langley (Google)] *) Fix spurious failures in ecdsatest.c. [Emilia Käóper (Google)] *) Fix the BIO_f_buffer() implementation (which was mixing different interpretations of the '..._len' fields). [Adam Langley (Google)] *) Fix handling of BN_BLINDING: now BN_BLINDING_invert_ex (rather than BN_BLINDING_invert_ex) calls BN_BLINDING_update, ensuring that concurrent threads won't reuse the same blinding coefficients. This also avoids the need to obtain the CRYPTO_LOCK_RSA_BLINDING lock to call BN_BLINDING_invert_ex, and avoids one use of BN_BLINDING_update for each BN_BLINDING structure (previously, the last update always remained unused). [Emilia Käóper (Google)] *) Fix SSL memory handling for (EC)DH ciphersuites, in particular for multi-threaded use of ECDH. [Adam Langley (Google)] *) Fix x509_name_ex_d2i memory leak on bad inputs. [Bodo Moeller] *) Add protection against ECDSA timing attacks as mentioned in the paper by Billy Bob Brumley and Nicola Tuveri, see: http://eprint.iacr.org/2011/232.pdf [Billy Bob Brumley and Nicola Tuveri] Changes between 0.9.8q and 0.9.8r [8 Feb 2011] *) Fix parsing of OCSP stapling ClientHello extension. CVE-2011-0014 [Neel Mehta, Adam Langley, Bodo Moeller (Google)] *) Fix bug in string printing code: if *any* escaping is enabled we must escape the escape character (backslash) or the resulting string is ambiguous. [Steve Henson] Changes between 0.9.8p and 0.9.8q [2 Dec 2010] *) Disable code workaround for ancient and obsolete Netscape browsers and servers: an attacker can use it in a ciphersuite downgrade attack. Thanks to Martin Rex for discovering this bug. CVE-2010-4180 [Steve Henson] *) Fixed J-PAKE implementation error, originally discovered by Sebastien Martini, further info and confirmation from Stefan Arentz and Feng Hao. Note that this fix is a security fix. CVE-2010-4252 [Ben Laurie]
2012-01-02Fixes a segfault in gssapi.c, taken from upstream Git repo.obache3-2/+29
PR#45765. Bump PKGREVISION of cy2-gssapi plugin package.
2011-12-30Fix for CVE-2011-4862 from FreeBSDtez3-3/+23
When an encryption key is supplied via the TELNET protocol, its length is not validated before the key is copied into a fixed-size buffer.
2011-12-29Also point configure to dnssec-signzonejoerg1-1/+2
2011-12-28Drop the sed calls that want to be gsed specific, since they don'tjoerg3-3/+28
actually seem to change anything (with gsed).
2011-12-28Because of adding gsed to USE_TOOLS there's no need for patch-ah or having asbd3-21/+3
build dependence on gsed. Bump PKGREVISION.
2011-12-26If something is patched to use gsed then gsed must be added to USE_TOOLS.sbd1-2/+2
2011-12-25Include deve/ncurses/buildlink3.mk not mk/curses.buildlink3.mk.sbd1-2/+2
Note: pinentry may need INCOMPAT_CURSES to be set for some platforms.
2011-12-23Fix for CVE-2011-4862 from FreeBSDtez3-3/+23
When an encryption key is supplied via the TELNET protocol, its length is not validated before the key is copied into a fixed-size buffer. This is a remote root exploit that is being actively exploited in the wild.
2011-12-22Fix build with newer heimdaljoerg2-1/+14
2011-12-22Unprivileged users don't have /usr/sbin in PATH on NetBSD, so dealjoerg1-1/+5
with it.
2011-12-21Disable probe for gmake; PR 45729dholland2-6/+10
2011-12-21Set LICENSE, from Pierre Pronchery in PR 45729.wiz1-1/+2
2011-12-21Fix PLIST on NetBSD-5.99.58.wiz3-7/+6
Remove line from distinfo for non-existing patch. I guess the non-existing patch might have fixed it up, but as it's not there....
2011-12-18Don't use "bool" as a variable name. This package now builds. (at long last)dholland2-1/+23
2011-12-18Include mk/curses.buildlink3.mk not mk/termcap.buildlink3.mk.sbd1-2/+2
2011-12-17Add missing mk/curses buildlink.sbd1-1/+3
Bump PKGREVISION
2011-12-17Add missing mk/termcap buildlink.sbd1-2/+3
Bump PKGREVISION
2011-12-17security/botan: Fix DragonFlymarino4-2/+32
1) Update two configuration files to include DragonFly, which results in additional generated files. 2) Update PLIST.DragonFly (it was wrong in any case)
2011-12-17Change default PKGNAME scheme for PECL packages.obache1-1/+2
Drop ${PHP_BASE_VARS} from PKGVERSION by default. It used to be required to support multiple php version. But after PHP version based ${PHP_PKG_PREFIX} was introduced, such trick is not required anymore. In addition to this, such version name schme invokes unwanted version bump when base php version is bumped, plus, such version scheme is hard to use for DEPENDS pattern. To avoid downgrading of package using such legacy version scheme, PECL_LEGACY_VERSION_SCHEME is introduced. If it is defined, current version scheme is still used for currently supported PHP version (5 and 53), but instead of ${PHP_BASE_VARS}, current fixed PHP base version in pkgsrc is used to avoid unwanted version bump from update of PHP base package. With newer PHP (54, or so on), new version scheme will be used if it is defined. This trick will not be required and should be removed after php5 and php53 will be gone away from pkgsrc.
2011-12-17security/qca2-ossl: Support OpenSSL 1.0marino3-7/+262
DragonFly in on OpenSSL 1.0 and this package wasn't building due to the missing MD5 digest that no longer builds by default on the latest versions of OpenSSL. FreeBSD already ran into this and patched qca-ossl, and this ports their fix to pkgsrc.
2011-12-17Add missing mk/termcap buildlink.sbd2-8/+6
Bump PKGREVISION
2011-12-16-explicitely disable kerberos support to avoid PLIST fluctuationsdrochner5-46/+38
(seen in bulk build) -fix obvious typo in asm code (fixes i386 build) -don't install nettle library to avoid conflict with pkgsrc/nettle bump PKGREV
2011-12-14Version 1.10.4pettai2-6/+6
* liboath: Fix build so that OATH_VERSION_NUMBER is actually defined. It was an empty value in the last release due to a bug in the build scripts. Version 1.10.3 * liboath: Allow strcmp callback to return negative to signal errors. * Fix bugs in build scripts for generating version numbers. * Update gnulib files.
2011-12-14Regenerate diffs for GNU patch.sbd2-7/+9
2011-12-13added prevention of CVE-2011-4122 taken from NetBSD srcspz3-5/+23
2011-12-12OpenDNSSEC 1.3.4pettai3-8/+10
Bugfixes: * Signer: Use debug instead of warning for drudgers queue being full, also sleep 10 ms if it is full to not hog CPU. This increased signing speed on single core machines by a factor of 2.
2011-12-10Fix build failure on Solaris (PR 28226).cheusov3-7/+26
2011-12-09In OWN_DIRS_PERMS change ROOT_GROUP to REAL_ROOT_GROUPsbd1-2/+2
2011-12-08Update stunnel to 4.50 (from 4.46).jym2-7/+6
Version 4.50, 2011.12.03, urgency: MEDIUM: New features Added Android port. Updated INSTALL.FIPS. Bugfixes Fixed internal memory allocation problem in inetd mode. Fixed FIPS mode on Microsoft Vista, Server 2008, and Windows 7. This fix required to compile OpenSSL FIPS-compliant DLLs with MSVC 9.0, instead of MSVC 10.0. msvcr100.dll was replaced with msvcr90.dll. GPL compatibility issues are explained in the GPL FAQ: http://www.gnu.org/licenses/gpl-faq.html#WindowsRuntimeAndGPL POP3 server-side protocol negotiation updated to report STLS capability (thx to Anthony Morgan). Version 4.49, 2011.11.28, urgency: MEDIUM: Bugfixes Missing Microsoft Visual C++ Redistributable (msvcr100.dll) required by FIPS-compliant OpenSSL library was added to the Windows installer. A bug was fixed causing crashes on MacOS X and some other platforms. Version 4.48, 2011.11.26, urgency: MEDIUM: New features FIPS support on Win32 platform added. OpenSSL 0.9.8r DLLs based on FIPS 1.2.3 canister are included with this version of stunnel. FIPS mode can be disabled with "fips = no" configuration file option. Bugfixes Fixed canary initialization problem on Win32 platform. Version 4.47, 2011.11.21, urgency: MEDIUM: Internal improvements CVE-2010-3864 workaround improved to check runtime version of OpenSSL rather than compiled version, and to allow OpenSSL 0.x.x >= 0.9.8p. Encoding of man page sources changed to UTF-8. Bugfixes Handling of socket/SSL close in transfer() function was fixed. Logging was modified to save and restore system error codes. Option "service" was restricted to Unix, as since stunnel 4.42 it wasn't doing anything useful on Windows platform.
2011-12-08Move the *_amd64 PLIST entries out of the common file and into all of thejmmv7-9/+19
platform files except Darwin. Also add the *_sse2 entries to Darwin. Note that both *_amd64 and *_sse2 are conditional on x86_64, so this division of files per platform is easier to do by PLIST tweaks than by further Makefile conditionals. This fixes the build of botan under OS X Lion with ABI=64 and should be a no-op for all other platforms.
2011-12-06Fix build with newer GCCjoerg2-1/+14
2011-12-06Recursive bump for lang/ocaml buildlink addition.sbd1-2/+2
2011-12-05pwrite is a standard system calljoerg2-1/+33
2011-12-05Added oath-toolkitpettai1-1/+2
2011-12-05The OATH Toolkit contains a shared library, command line tool and a PAM modulepettai4-0/+55
that makes it possible to build one-time password authentication systems. Supported technologies include the event-based HOTP algorithm and the time-based TOTP algorithm. OATH is the Open AuTHentication organization which specify the algorithms.
2011-12-04Remove some i386-specific files which are no longer installed.riz1-5/+1
2011-12-03Tag the 28 locations that result in a Python 3.1 package as supporting so.joerg3-3/+9
Remove it from the default list for the rest.
2011-12-02Recursive bump for devel/apr buildlink addition.sbd1-2/+2
2011-12-01Update to version 1.17.he2-7/+6
Upstream changes: Gisle Aas (6): Less noisy 'git status' output Merge pull request #1 from schwern/bug/require_eval Don't clobber $@ in Digest->new [RT#50663] More meta info added to Makefile.PL Fix typo in RIPEMD160 [RT#50629] Add schwern's test files Michael G. Schwern (5): Turn on strict. Convert tests to use Test::More Untabify Turn Digest::Dummy into a real file which exercises the Digest->new() require logic. Close the eval "require $module" security hole in Digest->new($algorithm)
2011-12-01Fix typo.wiz1-2/+2
2011-12-01Fixed COMMENTpettai1-3/+3
2011-11-30Added pam-krb5pettai1-1/+2
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-25 23:49:18 +0000