summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2014-11-24+ py-oauth2clientwiz1-1/+2
2014-11-24Import py34-oauth2client-1.4.1 as security/py-oauth2client.wiz4-0/+84
This is a client library for accessing resources protected by OAuth 2.0.
2014-11-24+ py-rsa.wiz1-1/+2
2014-11-24Import py34-rsa-3.1.4 as security/py-rsa.wiz4-0/+94
Python-RSA is a pure-Python RSA implementation. It supports encryption and decryption, signing and verifying signatures, and key generation according to PKCS#1 version 1.5. It can be used as a Python library as well as on the commandline.
2014-11-24+ py-asn1-moduleswiz1-1/+2
2014-11-24Import py34-asn1-modules-0.0.5 as security/py-asn1-modules.wiz4-0/+94
This is a small but growing collection of ASN.1 data structures expressed in Python terms using the pyasn1 data model. It's thought to be useful to protocol developers and testers.
2014-11-23Update to 2.006:wiz2-6/+6
2.006 2014/11/22 - Make (hopefully) non-blocking work on windows by using EWOULDBLOCK instead of EAGAIN. While this is the same on UNIX it is different on Windows and socket operations return there (WSA)EWOULDBLOCK and not EAGAIN. Enable non-blocking tests on Windows too. - make PublicSuffix::_default_data thread safe - update PublicSuffix with latest list from publicsuffix.org
2014-11-21Just because GAS accepts something doesn't make it valid syntax.joerg2-1/+24
2014-11-21Treat Haiku same as NetBSD.obache1-1/+2
patch from Бородулин Виталий in pkgsrc-users@.
2014-11-19Update to 1.1.11: locale improvements.wiz2-6/+6
2014-11-18Adapt a fix for SA59651, similar to CVE-2014-3209 from thehe4-5/+43
code branch fro SoftHSMv2: ensure created pkcs8 file is not group- or world-readable. Rename patch-aa to patch-Makefile.in, and add a comment. Bump PKGREVISION.
2014-11-17Uses old-style exception syntax.joerg1-1/+3
2014-11-17Needs help2man. Has racy build.joerg1-1/+5
2014-11-16Update to 2.005:wiz2-6/+6
2.005 2014/11/15 - next try to fix t/protocol_version.t for OpenSSL w/o SSLv3 support 2.004 2014/11/15 - only test fix: fix t/protocol_version.t to deal with OpenSSL installations which are compiled without SSLv3 support. 2.003 2014/11/14 - make SSLv3 available even if the SSL library disables it by default in SSL_CTX_new (like done in LibreSSL). Default will stay to disable SSLv3, so this will be only done when setting SSL_version explicitly. - fix possible segmentation fault when trying to use an invalid certificate, reported by Nick Andrew. - Use only the ICANN part of the default public suffix list and not the private domains. This makes existing exceptions for s3.amazonaws.com and googleapis.com obsolete. Thanks to Gervase Markham from mozilla.org.
2014-11-14Updated COMMENTpettai1-2/+2
2014-11-14Added py-yubiauthpettai1-1/+2
2014-11-14YubiAuth provides a user management system which can be used as apettai4-0/+135
base for other systems. It allows the creation of users, which can be authenticated by username, password, and optionally a YubiKey OTP. Aside from providing a user authentication backend, YubiAuth allows storing and retrieving arbitrary key-value attributes for each user as well as each YubiKey.
2014-11-14Version 1.16.1 (released 2014-10-30)pettai2-6/+6
* Fix udev rules so they contain four digits. * Only try to detach the kernel driver if it's attached. For libusb-1.0 * Let import config report errors properly.
2014-11-14Added libykneomgrpettai1-1/+2
2014-11-14This is a C library to interact with the CCID-part of the YubiKeypettai4-0/+53
NEO. There is a command line tool "ykneomgr" for interactive use. It supports querying the YubiKey NEO for firmware version, operation mode (OTP/CCID) and serial number. You may also mode switch the device and manage applets (list, delete and install).
2014-11-14Update polarssl to 1.2.12.obache2-6/+6
PolarSSL ChangeLog = Version 1.2.12 released 2014-10-24 Security * Remotely-triggerable memory leak when parsing some X.509 certificates (server is not affected if it doesn't ask for a client certificate). (Found using Codenomicon Defensics.) Bugfix * Fix potential bad read in parsing ServerHello (found by Adrien Vialletelle). * ssl_close_notify() could send more than one message in some circumstances with non-blocking I/O. * x509_crt_parse() did not increase total_failed on PEM error * Fix compiler warnings on iOS (found by Sander Niemeijer). * Don't print uninitialised buffer in ssl_mail_client (found by Marc Abel). * Fix net_accept() regarding non-blocking sockets (found by Luca Pesce). * ssl_read() could return non-application data records on server while renegotation was pending, and on client when a HelloRequest was received. * Fix warnings from Clang's scan-build (contributed by Alfred Klomp). Changes * X.509 certificates with more than one AttributeTypeAndValue per RelativeDistinguishedName are not accepted any more. * ssl_read() now returns POLARSSL_ERR_NET_WANT_READ rather than POLARSSL_ERR_SSL_UNEXPECTED_MESSAGE on harmless alerts. * Accept spaces at end of line or end of buffer in base64_decode().
2014-11-13kwallet becomes kwalletmanagermarkd1-2/+2
2014-11-13Update to KDE SC 4.14.3markd8-16/+24
2014-11-10Version 1.16.0 (released 2014-09-26)pettai2-6/+6
* Add yk_get_key_vid_pid() to get the vendor and product id of a key. * Add flags for ykinfo to print vendor and product id. * Fix a bug in the osx backend where it would return an error opening a composite device with two hid interfaces.
2014-11-10Version 2.13 (released 2014-09-12)pettai2-6/+6
* libykclient: Skip responses where the curl status isn't CURLE_OK. * libykclient: Add forgotten prototype for ykclient_set_ca_info.
2014-11-10Version 2.17 (released 2014-08-26)pettai3-7/+8
* Fix a bug with the 'urllist' parameter where urls would be forgotten. * Manpages converted to asciidoc. Version 2.16 (released 2014-06-10) * Fix a crashbug with the new parameter 'urllist' Version 2.15 (released 2014-04-30) * Added new parameter 'urllist' * Added pam_yubico(8) man page. * Fix memory leak. * Bump yubico-c-client version requirement to 2.12.
2014-11-07Revbump after updating boostadam5-10/+10
2014-11-07Update to 5.07. From the changelog:schmonz4-14/+16
Version 5.07, 2014.11.01, urgency: MEDIUM: * New features - Several SMTP server protocol negotiation improvements. - Added UTF-8 byte order marks to stunnel.conf templates. - DH parameters are no longer generated by "make cert". The hardcoded DH parameters are sufficiently secure, and modern TLS implementations will use ECDH anyway. - Updated manual for the "options" configuration file option. - Added support for systemd 209 or later. - New --disable-systemd ./configure option. - setuid/setgid commented out in stunnel.conf-sample. * Bugfixes - Added support for UTF-8 byte order mark in stunnel.conf. - Compilation fix for OpenSSL with disabled SSLv2 or SSLv3. - Non-blocking mode set on inetd and systemd descriptors. - shfolder.h replaced with shlobj.h for compatibility with modern Microsoft compilers. Version 5.06, 2014.10.15, urgency: HIGH: * Security bugfixes - OpenSSL DLLs updated to version 1.0.1j. https://www.openssl.org/news/secadv_20141015.txt - The insecure SSLv2 protocol is now disabled by default. It can be enabled with "options = -NO_SSLv2". - The insecure SSLv3 protocol is now disabled by default. It can be enabled with "options = -NO_SSLv3". - Default sslVersion changed to "all" (also in FIPS mode) to autonegotiate the highest supported TLS version. * New features - Added missing SSL options to match OpenSSL 1.0.1j. - New "-options" commandline option to display the list of supported SSL options. * Bugfixes - Fixed FORK threading build regression bug. - Fixed missing periodic Win32 GUI log updates. Version 5.05, 2014.10.10, urgency: MEDIUM: * New features - Asynchronous communication with the GUI thread for faster logging on Win32. - systemd socket activation (thx to Mark Theunissen). - The parameter of "options" can now be prefixed with "-" to clear an SSL option, for example: "options = -LEGACY_SERVER_CONNECT". - Improved "transparent = destination" manual page (thx to Vadim Penzin). * Bugfixes - Fixed POLLIN|POLLHUP condition handling error resulting in prematurely closed (truncated) connection. - Fixed a null pointer dereference regression bug in the "transparent = destination" functionality (thx to Vadim Penzin). This bug was introduced in stunnel 5.00. - Fixed startup thread synchronization with Win32 GUI. - Fixed erroneously closed stdin/stdout/stderr if specified as the -fd commandline option parameter. - A number of minor Win32 GUI bugfixes and improvements. - Merged most of the Windows CE patches (thx to Pierre Delaage). - Fixed incorrect CreateService() error message on Win32. - Implemented a workaround for defective Cygwin file descriptor passing breaking the libwrap support: http://wiki.osdev.org/Cygwin_Issues#Passing_file_descriptors Version 5.04, 2014.09.21, urgency: LOW: * New features - Support for local mode ("exec" option) on Win32. - Support for UTF-8 config file and log file. - Win32 UTF-16 build (thx to Pierre Delaage for support). - Support for Unicode file names on Win32. - A more explicit service description provided for the Windows SCM (thx to Pierre Delaage). - TCP/IP dependency added for NT service in order to prevent initialization failure at boot time. - FIPS canister updated to version 2.0.8 in the Win32 binary build. * Bugfixes - load_icon_default() modified to return copies of default icons instead of the original resources to prevent the resources from being destroyed. - Partially merged Windows CE patches (thx to Pierre Delaage). - Fixed typos in stunnel.init.in and vc.mak. - Fixed incorrect memory allocation statistics update in str_realloc(). - Missing REMOTE_PORT environmental variable is provided to processes spawned with "exec" on Unix platforms. - Taskbar icon is no longer disabled for NT service. - Fixed taskbar icon initialization when commandline options are specified. - Reportedly more compatible values used for the dwDesiredAccess parameter of the CreateFile() function (thx to Pierre Delaage). - A number of minor Win32 GUI bugfixes and improvements.
2014-11-04Add missing dependency for the cffi use.joerg1-1/+2
2014-11-04There's one more useless ntohl(), get rid of that as well.he3-6/+15
Bump PKGREVISION.
2014-11-02Add and enable libgfshareagc1-1/+2
2014-11-02Initial import of libgfshare-1.0.5, a library which implements Shamir'sagc4-0/+40
Secret Sharing Scheme, into the packages collection. In simple terms, this package provides a library for implementing the sharing of secrets and two tools for simple use-cases of the algorithm. The library implements what is known as Shamir's method for secret sharing in the Galois Field 2^8. In slightly simpler words, this is N-of-M secret-sharing byte-by-byte. Essentially this allows us to split a secret S into any M shares S1..SM such that any N of those shares can be used to reconstruct S but any less than N shares yields no information whatsoever.
2014-10-31Fix a bug related to restoring various data from .xfrd-state files:he4-7/+34
there's no need to byte-swap values read from a local file. This would cause some IXFRs to mysteriously and consistently fail until manual intervention is done, because the wrong (byte-swapped) SOA serial# was being stuffed into the IXFR requests. Ref. https://issues.opendnssec.org/browse/SUPPORT-147. Also fix the rc.d script to not insist that the components must be running to allow "stop" to proceed, so that "restart" or "stop" can be done if one or both of the processes have exited or crashed. Bump PKGREVISION.
2014-10-30dd upstream bug report (by he@, thanks!)wiz2-3/+5
2014-10-29Use __attribute__((destructor)) instead of atexit(), so that thehe3-3/+39
library wind-down function is both called on dlclose() and exit(). Should avoid segfault when trying to call the atexit function after dlclose() which unmaps the library. Fixes PR pkg/49333, thanks to joerg@ for the suggested fix. Also, the IRIX and NetBSD tool name to get at nawk is just "awk", flagged by pkglint. Bump PKGREVISION.
2014-10-28Add an rc.d script for NetBSD.he2-2/+139
2014-10-27Update to 5.93wen2-6/+6
Upstream changes: 5.93 Sun Oct 26 06:00:48 MST 2014 - corrected alignment problem in SHA struct (src/sha.h) -- thanks to H. Merijn Brand and J. Hietaniemi for analysis and suggested patch - provided workaround in t/methods.t for unreliable -T test -- Some Perl 5.8's mistake text for binary
2014-10-23Update to 2.002:wiz2-6/+6
2.002 2014/10/21 - fix check for (invalid) IPv4 when validating hostname against certificate. Do not use inet_aton any longer because it can cause DNS lookups for malformed IP. RT#99448, thanks to justincase[AT]yopmail[DOT]com. - Update PublicSuffix with latest version from publicsuffix.org - lots of new top level domains. - Add exception to PublicSuffix for s3.amazonaws.com - RT#99702, thanks to cpan[AT]cpanel[DOT]net. 2.001 2014/10/21 - Add SSL_OP_SINGLE_(DH|ECDH)_USE to default options to increase PFS security. Thanks to Heikki Vatiainen for suggesting. - Update external tests with currently expected fingerprints of hosts. - Some fixes to make it still work on 5.8.1.
2014-10-21Update spiped to 1.4.2wiedi2-6/+6
Changelog: spiped-1.4.2 * Fix crash on platforms which support AESNI (i386, amd64) but do not automatically provide 16-byte alignment to large memory allocations (glibc, possibly others).
2014-10-20Update to 0.6.1:wiz3-7/+10
0.6.1 - 2014-10-15 ~~~~~~~~~~~~~~~~~~ * Updated Windows wheels to be compiled against OpenSSL 1.0.1j. * Fixed an issue where OpenSSL 1.0.1j changed the errors returned by some functions. * Added our license file to the ``cryptography-vectors`` package. * Implemented DSA hash truncation support (per FIPS 186-3) in the OpenSSL backend. This works around an issue in 1.0.0, 1.0.0a, and 1.0.0b where truncation was not implemented.
2014-10-20Added camlp4 dependency.jaapb1-1/+2
2014-10-20Update to 1.17:wiz3-7/+10
Noteworthy changes in version 1.17 (2014-10-15) [C13/A13/R0] ----------------------------------------------- * New error codes for TLS protocol libraries. * New configure option --enable-build-timestamp. * New man page for gpg-error-config.
2014-10-20Update to 2.000:wiz2-6/+6
2.000 2014/10/15 - consider SSL3.0 as broken because of POODLE and disable it by default. - Skip live tests without asking if environment NO_NETWORK_TESTING is set. Thanks to ntyni[AT]debian[DOT]org for suggestion. - skip tests which require fork on non-default windows setups without proper fork. Thanks to SHAY for https://github.com/noxxi/p5-io-socket-ssl/pull/18
2014-10-19Revbump after lang/lua51 update.alnsn3-6/+6
2014-10-16Don't hand-process $required_dirs and $required_files. This is provideddholland1-17/+1
by the infrastructure. Tangentially related to PR 48555.
2014-10-15Add back manual page which somehow was removed yet got past install checks.jperkin1-1/+2
2014-10-15Update to openssl-1.0.1j.jperkin3-9/+14
Changes between 1.0.1i and 1.0.1j [15 Oct 2014] *) SRTP Memory Leak. A flaw in the DTLS SRTP extension parsing code allows an attacker, who sends a carefully crafted handshake message, to cause OpenSSL to fail to free up to 64k of memory causing a memory leak. This could be exploited in a Denial Of Service attack. This issue affects OpenSSL 1.0.1 server implementations for both SSL/TLS and DTLS regardless of whether SRTP is used or configured. Implementations of OpenSSL that have been compiled with OPENSSL_NO_SRTP defined are not affected. The fix was developed by the OpenSSL team. (CVE-2014-3513) [OpenSSL team] *) Session Ticket Memory Leak. When an OpenSSL SSL/TLS/DTLS server receives a session ticket the integrity of that ticket is first verified. In the event of a session ticket integrity check failing, OpenSSL will fail to free memory causing a memory leak. By sending a large number of invalid session tickets an attacker could exploit this issue in a Denial Of Service attack. (CVE-2014-3567) [Steve Henson] *) Build option no-ssl3 is incomplete. When OpenSSL is configured with "no-ssl3" as a build option, servers could accept and complete a SSL 3.0 handshake, and clients could be configured to send them. (CVE-2014-3568) [Akamai and the OpenSSL team] *) Add support for TLS_FALLBACK_SCSV. Client applications doing fallback retries should call SSL_set_mode(s, SSL_MODE_SEND_FALLBACK_SCSV). (CVE-2014-3566) [Adam Langley, Bodo Moeller] *) Add additional DigestInfo checks. Reencode DigestInto in DER and check against the original when verifying RSA signature: this will reject any improperly encoded DigestInfo structures. Note: this is a precautionary measure and no attacks are currently known. [Steve Henson]
2014-10-12Update to 1.1.10: locale improvements.wiz2-6/+6
2014-10-12Update to 1.999:wiz2-6/+6
1.999 2014/10/09 - make sure we don't use version 0.30 of IO::Socket::IP - make sure that PeerHost is checked on all places where PeerAddr is checked, because these are synonyms and IO::Socket::IP prefers PeerHost while others prefer PeerAddr. Also accept PeerService additionally to PeerPort. See https://github.com/noxxi/p5-io-socket-ssl/issues/16 for details. - add ability to use client certificates and to overwrite hostname with util/analyze-ssl.pl.
2014-10-10Remove unneeded patch.wiz1-20/+0
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-26 07:45:42 +0000