summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2021-06-16kauth: buildlink libexec/kauth/* files. needed for latest cmakemarkd1-1/+3
2021-06-14security/ruby-metasploit_payloads-mettle: update to 1.0.10taca2-7/+7
Quote from commit logs: 1.0.10 (2021-06-09) * Support enumerating platforms for a extension * Fixup enumerating the extensions for a platform * Remove an extra word word
2021-06-14security/ruby-metasploit-payloads: update to 2.0.47taca2-7/+7
Quote from commit logs: 2.0.47 (2021-06-09) * Support enumerating all extension names * Support enumerating Meterpreter extension suffixs * Fix a typo in how suffixes is spelled * Rename a function and update a regex
2021-06-14py-certifi: updated to 2021.5.30adam2-7/+7
2021.5.30: Unknown changes
2021-06-14py-acme py-certbot*: updated to 1.16.0adam24-96/+96
Certbot 1.16.0 Changed DNS plugins based on lexicon now require dns-lexicon >= v3.1.0 Use UTF-8 encoding for renewal configuration files Windows installer now cleans up old Certbot dependency packages before installing the new ones to avoid version conflicts. This release contains a substantial command-line UX overhaul, based on previous user research. The main goal was to streamline and clarify output. If you would like to see more verbose output, use the -v or -vv flags. UX improvements are an iterative process and the Certbot team welcomes constructive feedback. Functions certbot.crypto_util.init_save_key and certbot.crypto_util.init_save_csr, whose behaviors rely on the global Certbot config singleton, are deprecated and will be removed in a future release. Please use certbot.crypto_util.generate_key and certbot.crypto_util.generate_csr instead. Fixed Fix TypeError due to incompatibility with lexicon >= v3.6.0 Installers (e.g. nginx, Apache) were being restarted unnecessarily after dry-run renewals. Colors and bold text should properly render in all supported versions of Windows.
2021-06-14security/gpg-tui: update to 0.5.0pin3-23/+43
[0.5.0] - 2021-06-13 Added: -Support setting the default signing key via options menu Changed: -Update Dockerfile about crate dependency location -Update COMMANDS.md about getting/setting default signing key -Update README.md about setting the default signing key
2021-06-13py-trustme: updated to 0.8.0adam2-7/+7
Trustme 0.8.0 (2021-06-08) Features It’s now possible to set an expiry date on server certificates, either with --expires-on in the CLI or with not_after in trustme.CA.issue_cert. Support Python 3.10 Set correct KeyUsage and ExtendedKeyUsage extensions, per CA/B Forum baseline requirements
2021-06-13security/sudo: update to 1.9.7p1taca2-7/+7
1.9.7p1 (2021-06-11) What's new in Sudo 1.9.7p1 * Fixed an SELinux sudoedit bug when the edited temporary file could not be opened. The sesh helper would still be run even when there are no temporary files available to install. * Fixed a compilation problem on FreeBSD. * The sudo_noexec.so file is now built as a module on all systems other than macOS. This makes it possible to use other libtool implementations such as slibtool. On macOS shared libraries and modules are not interchangeable and the version of libtool shipped with sudo must be used. * Fixed a few bugs in the getgrouplist() emulation on Solaris when reading from the local group file. * Fixed a bug in sudo_logsrvd that prevented periodic relay server connection retries from occurring in "store_first" mode. * Disabled the nss_search()-based getgrouplist() emulation on HP-UX due to a crash when the group source is set to "compat" in /etc/nsswitch.conf. This is probably due to a mismatch between include/compat/nss_dbdefs.h and what HP-UX uses internally. On HP-UX we now just cycle through groups the slow way using getgrent(). Bug #978.
2021-06-12acmesh: update to 2.9.0nia2-7/+7
ACME v1 is removed. Bug fixes. fixed --preferred-chain more DNS APIs are supported.
2021-06-10Add missed "include go-modules.mk"abs1-1/+3
2021-06-10security/gpg-tui: update to 0.4.1pin3-8/+13
[0.4.1] - 2021-06-09 Fixed: -Expand tilde character to the home directory (fixes #22)
2021-06-10p11-kit: update to 0.24.0.wiz3-25/+8
0.24.0 (stable) * Use inclusive language on certificate distrust. Note: This changes the directory and attribute names to distrust certain CAs to "blocklist" [PR#324] * Fix issues spotted by coverity and ASan [PR#349, PR#351] * Integrate gettext with tools more tightly [PR#358] * rpc: Forbid use of array of attributes [PR#365, PR#367] * Build fixes [PR#342, PR#344, PR#345, PR#353, PR#362, PR#364]
2021-06-09+security/ageabs1-1/+2
2021-06-09Added security/age version 1.0.0rc2abs5-0/+104
age is a simple, modern and secure file encryption tool, format, and Go library. It features small explicit keys, no config options, and UNIX-style composability The format specification is at age-encryption.org/v1. age was designed by @Benjojo12 and @FiloSottile. An alternative interoperable Rust implementation is available at github.com/str4d/rage.
2021-06-08security/gpg-tui: update to 0.4.0pin2-7/+7
[0.4.0] - 2021-06-07 Changed: -Extract get_output_file from export_keys method -Support exporting secret subkeys (#15) -Update COMMANDS.md about export command -Update README.md about exporting secret subkeys
2021-06-08Update security/crudesaml, cy2-saml and pam-saml to 1.10manu2-7/+7
Change since 1.9 from the Changelog file crusdesaml-1.10 2021-06-06 Shutdown/reinit lasso in a process liftime is not supported (Florian Best)
2021-06-08Update lasso to 2.7.0manu5-201/+11
Changes from 2.6.1, from the NEWS file 2.7.0 - June 1st 2021 ---------------------- 36 commits, 45 files changed, 1945 insertions, 177 deletions * CVE-2021-28091: Fix signature checking on unsigned response with multiple assertions https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28091 When AuthnResponse messages are not signed (which is permitted by the specifiation), all assertion's signatures should be checked, but currently after the first signed assertion is checked all following assertions are accepted without checking their signature, and the last one is considered the main assertion. This patch : * check signatures from all assertions if the message is not signed, * refuse messages with assertion from different issuers than the one on the message, to prevent assertion bundling event if they are signed. * Python: improve display of warnings in the binding generator * replace deprecated index() by strchr() (#51385) * Fix: new provider reference count is incremented one time too many (#51420) * docs: update gtk-doc-tools integration (#50441) * bindings: disable java tests when java is disabled * Fix: python3 bindings (#51249) * configure.ac: disable java bindings * build: update to use origin/main * debian: add packaging for debian-buster * jenkins.sh: build against all available python versions (#44287) * python: do not leak out_pyvalue if method call protocol is not respected (#44287) * python: do not raise in valid_seq() (#44287) * python: return NULL if get_list_of_strings() fails (#44287) * python: return NULL if get_list_of_pygobject fails (#44287) * python: return NULL if get_list_of_xml_nodes fails (#44287) * python: return NULL if set_list_of_pygobject fails (#44287) * python: return NULL if set_list_of_xml_nodes fails (#44287) * python: return NULL if set_list_of_strings fails (#44287) * python: return NULL if set_hashtable_of_strings fails (#44287) * python: return NULL if set_hashtable_of_pygobject fails (#44287) * python: free internal string buffer if needed in set_list_of_strings (#44287) * python: check if hashtable is NULL before deallocatio (#44287)n * python: add a failure label to method wrappers (#44287) * python: add macro for early return (#44287) * python: remove newline before method call (#44287) * python: simplify get_logger_object (#44287) * python: fix warning about discarded const modifier (#44287) * python: replace exception by warning on logging path (#44287) * python: use simpler call format to prevent warning about PY_SSIZE_T_CLEAN (#44287) * python: remove deprecated PyErr_Warn (#44287) * python: remove unused PyString_Size (#44287) * python: Exception.message was removed in python3 (#45995) * tools: reimplement xmlURIEscapeStr to respect RFC3986 (#45581) * configure.ac: support php7 interpreter on CentOS 8 (#42299)
2021-06-07nettle: updated to 3.7.3adam2-7/+7
NEWS for the Nettle 3.7.3 release This is bugfix release, fixing bugs that could make the RSA decryption functions crash on invalid inputs. Upgrading to the new version is strongly recommended. For applications that want to support older versions of Nettle, the bug can be worked around by adding a check that the RSA ciphertext is in the range 0 < ciphertext < n, before attempting to decrypt it. Thanks to Paul Schaub and Justus Winter for reporting these problems. The new version is intended to be fully source and binary compatible with Nettle-3.6. The shared library names are libnettle.so.8.4 and libhogweed.so.6.4, with sonames libnettle.so.8 and libhogweed.so.6. Bug fixes: * Fix crash for zero input to rsa_sec_decrypt and rsa_decrypt_tr. Potential denial of service vector. * Ensure that all of rsa_decrypt_tr and rsa_sec_decrypt return failure for out of range inputs, instead of either crashing, or silently reducing input modulo n. Potential denial of service vector. * Ensure that rsa_decrypt returns failure for out of range inputs, instead of silently reducing input modulo n. * Ensure that rsa_sec_decrypt returns failure if the message size is too large for the given key. Unlike the other bugs, this would typically be triggered by invalid local configuration, rather than by processing untrusted remote data.
2021-06-07tor-browser-noscript: update to 11.2.8.wiz2-7/+7
v 11.2.8 ============================================================ x Quiet down unnecessary debug logging (issue #191) x [L10n] Updated he, de x Fix meta refresh sometimes ignored on Firefox 78 ESR (issue #192, thanks hackerncoder for report) x Chromium-specific build-time customizations v 11.2.8rc2 ============================================================ x Quiet down unnecessary debug logging (issue #191) x [L10n] Updated he v 11.2.8rc1 ============================================================ x Fix meta refresh sometimes ignored on Firefox 78 ESR (issue #192, thanks hackerncoder for report) x [l10n] Updated de x Chromium-specific build-time customizations v 11.2.7 ============================================================ x Better prompt layout (no accidental scrollbar) x [nscl] Fix regression causing media patches to break some pages (thanks l0drex for report, issue #189) v 11.2.6 ============================================================ x [nscl] Various webgl blocking enhancements x Remove also sticky-positioned elements with click+DEL on scriptless pages (thanks skriptimaahinen for RFE) x [L10n] Updated bn, br, ca, da, de, el, es, fr, he, is, it, ja, lt, mk, ms, nb, nl, pl, pt_BR, ru, sq, sv_SE, tr, zh_CN, zh_TW x Fixed race condition causing external CSS not to be rendered sometimes when unrestricted CSS is disabled x Avoid document rewriting for noscript meta refresh emulation in most cases x [nscl] Fixed XHTML pages broken when served with application/xml MIME type and no "object" capability x [nscl] Switch early content script configuration to use /nscl/service/DocStartInjection.js x Configurable "unrestricted CSS" capability to for sites where the CSS PP0 mitigation should be disabled (e.g TRUSTED) x [nscl] Fix CSS PP0 mitigation still interfering with some WebExtensions (thanks barbaz for report) x [XSS] Increased sensitivity and specificity of risky operator pre-checks v 11.2.6rc1 ============================================================ x [nscl] Various webgl blocking enhancements x Remove also sticky-positioned elements with click+DEL on scriptless pages (thanks skriptimaahinen for RFE) v 11.2.5rc6 ============================================================ x [L10n] Updated bn, br, ca, da, de, el, es, fr, he, is, it, ja, lt, mk, ms, nb, nl, pl, pt_BR, ru, sq, sv_SE, tr, zh_CN, zh_TW x Policy retrieval origin fine tuning v 11.2.5rc5 ============================================================ x Fixed hook not taking in account experimental webgl contexts (issue #187, thanks roman567e45 for report) v 11.2.5rc4 ============================================================ x Fixed regression in NOSCRIPT emulation (thanks barbaz for reporting) v 11.2.5rc3 ============================================================ x Fixed race condition causing external CSS not to be rendered sometimes when unrestricted CSS is disabled x Rename "unchecked CSS" capability to "unrestricted CSS" x Avoid document rewriting for noscript meta refresh emulation in most cases v 11.2.5rc2 ============================================================ x [nscl] Minor fixes from the library x [nscl] Fixed XHTML pages broken when served with application/xml MIME type and no "object" capability x [nscl] Switch early content script configuration to use /nscl/service/DocStartInjection.js x [nscl] Refactored ContentScriptOnce.js to the library x Rename the "csspp0" capability to "unchecked_css" v 11.2.5rc1 ============================================================ x Configurable "csspp0" capability to for sites where the CSS PP0 mitigation should be disabled (e.g TRUSTED) x [nscl] Fix CSS PP0 mitigation still interfering with some WebExtensions (thanks barbaz for report) x [XSS] Increased sensitivity and specificity of risky operator pre-checks
2021-06-07tor-browser: update to 10.0.17.wiz3-15/+25
This version updates Firefox to 78.11esr. This version includes important security updates to Firefox for Desktop. Warning: Tor Browser will stop supporting version 2 onion services later this year. Please see the previously published deprecation timeline. Migrate your services and update your bookmarks to version 3 onion services as soon as possible.
2021-06-07py-authlib: updated to 0.15.4adam2-7/+7
0.15.4: Unknown changes
2021-06-06Revbump all Go packages after go116 updatebsiegert10-18/+20
2021-06-06security/php-gnupg: update to 1.5.0taca3-25/+20
pkgsrc change: remove restriction to depeding package, requirement gpgme package to using gnupg1 PKG_OPTIONS. Approved by tpaul@. 1.5.0 (2021-04-10) * Added new README.md 1.5.0RC2 (2021-03-07) * Fixed build with libgpgme 1.3 * Fixed largefile support on 32-bit platforms * Fixed tests in PECL archive 1.5.0RC1 (2021-02-14) * Added support for PHP 8 * Added support for GnuPG 2.1+ * Added argument info for all functions and methods (reflection support) * Added new function `gnupg_getengineinfo` * Added new function `gnupg_geterrorinfo` * Added init array argument for setting home dir and gpg binary file name * Added additional fields to `gnupg_keyinfo` returned array * Added parameter to `gnupg_keyinfo` to use `secret_only` * Fixed `gnupg_deletekey` to use boolean for `allow_secret` parameter
2021-06-05security/gpg-tui: update to 0.3.0pin2-7/+7
[0.3.0] - 2021-06-05 Added: -Add packaging status badge to README.md -Add Matrix room link to social media section in README.md Changed: -Display notations of the signatures (#8) -Update README.md about Docker alias -Update README.md about the format of notations -Update the example notation in README.md -Update the style of flags Fixed: -Run container process as unprivileged user
2021-06-05(security/clamav-doc) regen PLISTmef1-1/+2
2021-06-05(security/yara) build fix: ERROR: [check-portability.awk]mef2-1/+17
2021-06-04security/sudo: Drop MESSAGE (as hints to read docs)gdt1-10/+0
2021-06-03security/clamav: update to 0.103.2taca3-9/+8
0.103.2 (2021-04-07) ClamAV 0.103.2 is a security patch release with the following fixes: * CVE-2021-1386: Fix for UnRAR DLL load privilege escalation. Affects 0.103.1 and prior on Windows only. * CVE-2021-1252: Fix for Excel XLM parser infinite loop. Affects 0.103.0 and 0.103.1 only. * CVE-2021-1404: Fix for PDF parser buffer over-read; possible crash. Affects 0.103.0 and 0.103.1 only. * CVE-2021-1405: Fix for mail parser NULL-dereference crash. Affects 0.103.1 and prior. * Fix possible memory leak in PNG parser. * Fix ClamOnAcc scan on file-creation race condition so files are scanned after their contents are written. * FreshClam: Deprecate the SafeBrowsing config option. The SafeBrowsing option will no longer do anything. * For more details, see our blog post from last year about the future of the ClamAV Safe Browsing database. * Tip: If creating and hosting your own safebrowing.gdb database, you can use the DatabaseCustomURL option in freshclam.conf to download it. * FreshClam: Improved HTTP 304, 403, & 429 handling. * FreshClam: Added back the mirrors.dat file to the database directory. This new mirrors.dat file will store: - A randomly generated UUID for the FreshClam User-Agent. - A retry-after timestamp that so FreshClam won't try to update after having received an HTTP 429 response until the Retry-After timeout has expired. * FreshClam will now exit with a failure in daemon mode if an HTTP 403 (Forbidden) was received, because retrying later won't help any. The FreshClam user will have to take actions to get unblocked. * Fix the FreshClam mirror-sync issue where a downloaded database is "older than the version advertised." * If a new CVD download gets a version that is older than advertised, FreshClam will keep the older version and retry the update so that the incremental update process (CDIFF patch process) will update to the latest version.
2021-06-03polkit: update to 0.119.wiz5-18/+14
Fix some pkglint, including renaming a patch to match the file it applies to. This is polkit 0.119. Highlights: meson build system added CVE-2021-3560 mitigation Build requirements glib, gobject, gio >= 2.32 mozjs-78 gobject-introspection >= 0.6.2 (optional) pam (optional) ConsoleKit OR systemd Changes since polkit 0.118: Inigo Martinez: meson build system added alongside autotools (many thanks!!) Matthias Classen: properties in text listener René Genz: typos fixups Balázs Úr: Update Hungarian translation Hendrik Werner: meson post-install script mod to avoid calling external processes Kevin Backhouse, Jan Rybar: CVE-2021-3560 mitigation Many thanks to all contributors! Jan Rybar et al., June 3, 2021
2021-06-03security/gpg-tui: update to 0.2.0pin2-7/+7
[0.2.0] - 2021-06-02 Added: -Add installation instructions for FreeBSD -Add Homebrew instructions to README.md -Add NetBSD instructions to README.md Changed: -Update table of contents -Support xplr for file selection (closes #2) -Use eprintln macro while printing errors -Update README.md about the use of xplr
2021-06-03security/Makefile: sortwiz1-2/+2
2021-06-02security/gpg-tui: fix mistakepin1-2/+2
2021-06-02security/gpg-tui: fix broken buildpin1-3/+3
2021-06-01security/ruby-rex-text: update to 0.2.34taca2-7/+7
Quote from commit logs: 0.2.34 (2021-04-08) * Land #41, Add rand_password method to Rex::Text
2021-06-01security/ruby-rex-socket: update to 0.1.29taca2-7/+7
Quote from commit logs: 0.1.29 (2021-03-25) * Land #31, Consistently return nil as the failure indicator 0.1.28 (2021-03-25) * Land #30, Fix Some RangeWalker issues 0.1.27 (2021-03-24) * Land #28, RangeWalker Updates To Return Hostnames When Available
2021-06-01security/ruby-rex-powershell: update to 0.1.90taca2-7/+7
0.1.90 (2021-04-23) * Land #30, Implement the rc4 wrapper
2021-06-01py-ecdsa: updated to 0.17.0adam3-8/+17
Relase 0.17.0 (27 May 2021) New API: * Keys that use explicit curve parameters can now be read and written. Reading of explicit curves can be disabled by using the `valid_curve_encodings` keyword argument in `VerifyingKey.from_pem()`, `VerifyingKey.from_der()`, `SigningKey.from_pem()`, and `SigningKey.from_der()`. * Keys can now be written with use of explicit curve parameters, use `curve_parameters_encoding` keyword argument of `VerifyingKey.to_pem()`, `VerifyingKey.to_der()`, `SigningKey.to_pem(), or `SigningKey.to_der()` to specify the format. By default `named_curve` will be used, unless the curve doesn't have an associated OID (as will be the case for an unsupported curve), then `explicit` encoding will be used. * Allow specifying acceptable point formats when loading public keys (this also fixes a minor bug where python-ecdsa would accept raw encoding for points in PKCS#8 files). Set of accepted encodings is controlled by `valid_encodings` keyword argument in `ECDH.load_received_public_key_bytes()`, `VerifyingKey.from_string()`, `VerifyingKey.from_pem()`, VerifyingKey.from_der()`. * `PointJacobi` and `Point` now inherit from `AbstractPoint` that implements the methods for parsing points. That added `from_bytes()` and `to_bytes()` methods to both of them. * Curve parameters can now be read and written to PEM and DER files. The `Curve` class supports new `to_der()`, `from_der()`, `to_pem()`, and `from_pem()` methods. Doc fix: * Describe in detail which methods can raise `RSZeroError`, and that `SigningKey.sign_deterministic()` won't raise it. Bug fix: * Correctly truncate hash values larger than the curve order (only impacted custom curves and the curves added in this release). * Correctly handle curves for which the order is larger than the prime (only impacted custom curves and the secp160r1 curve added in this release). * Fix the handling of `==` and `!=` for `Public_key`, `Private_key`, `Point`, `PointJacobi`, `VerifyingKey`, and `SigningKey` so that it behaves consistently and in the expected way both in Python 2 and Python 3. * Implement lock-less algorithm inside PointJacobi for keeping shared state so that when calculation is aborted with KeyboardInterrupt, the state doesn't become corrupted (this fixes the occasional breakage of ecdsa in interactive shells). New features: * The `speed.py` script now provides performance for signature verification without use of precomputation. * New curves supported: secp112r1, secp112r2, secp128r1, secp160r1. Performance: * Use 2-ary Non-Adjacent Form for the combined multiply-add. This speeds up single-shot verify (i.e. without precomputation) by about 4 to 5%. * Use native Python 3.8 support for calculating multiplicative inverses. Maintenace: * Include Python 3.9 in PyPI keywords. * More realistic branch coverage counting (ignore Python version-specific branches). * Additional test coverage to many parts of the library. * Migrate to Github Actions for Continuous Testing.
2021-05-31security/gpg-tui: update to 0.1.5pin2-7/+7
Added: -Add dependency installation instructions for Void Linux (#11) Changed: -Mention distribution-specific dependencies in README.md (#10) -Update the formatting of requirements in README.md -Update README.md about installation for Arch Linux
2021-05-31gnutls: update to 3.7.2.wiz3-9/+12
* Version 3.7.2 (released 2021-05-29) ** libgnutls: The priority string option %DISABLE_TLS13_COMPAT_MODE was added to disable TLS 1.3 middlebox compatibility mode ** libgnutls: The Linux kernel AF_ALG based acceleration has been added. This can be enabled with --enable-afalg configure option, when libkcapi package is installed (#308). ** libgnutls: Fixed timing of early data exchange. Previously, the client was sending early data after receiving Server Hello, which not only negates the benefit of 0-RTT, but also works under certain assumptions hold (e.g., the same ciphersuite is selected in initial and resumption handshake) (#1146). ** certtool: When signing a CSR, CRL distribution point (CDP) is no longer copied from the signing CA by default (#1126). ** libgnutls: The GNUTLS_NO_EXPLICIT_INIT envvar has been renamed to GNUTLS_NO_IMPLICIT_INIT to reflect the purpose (#1178). The former is now deprecated and will be removed in the future releases. ** certtool: When producing certificates and certificate requests, subject DN components that are provided individually will now be ordered by assumed scale (e.g. Country before State, Organization before OrganizationalUnit). This change also affects the order in which certtool prompts interactively. Please rely on the template mechanism for automated use of certtool! (#1243) ** API and ABI modifications: gnutls_early_cipher_get: Added gnutls_early_prf_hash_get: Added
2021-05-31Add gpg-tuipin1-1/+2
2021-05-31security/gpg-tui: import packagepin5-0/+654
Terminal User Interface for GnuPG. It aims to ease the key management operations such as listing/exporting/signing by providing an interface along with the command-line fallback for more complex operations. It is not trying to be a full-fledged interface for all the features that gpg provides but it tries to bring a more interactive approach to key management.
2021-05-30Upgrade security/vault to version 1.6.5.he2-8/+7
Pkgsrc changes: * None Upstream changes: v1.6.5: May 20th, 2021 SECURITY: * Non-Expiring Leases: Vault and Vault Enterprise renewed nearly-expiring token leases and dynamic secret leases with a zero-second TTL, causing them to be treated as non-expiring, and never revoked. This issue affects Vault and Vault Enterprise versions 0.10.0 through 1.7.1, and is fixed in 1.5.9, 1.6.5, and 1.7.2 (CVE-2021-32923). CHANGES: * agent: Update to use IAM Service Account Credentials endpoint for signing JWTs when using GCP Auto-Auth method [GH-11473] * auth/gcp: Update to v0.8.1 to use IAM Service Account Credentials API for signing JWTs [GH-11498] BUG FIXES: * core (enterprise): Fix plugins mounted in namespaces being unable to use password policies [GH-11596] * core: correct logic for renewal of leases nearing their expiration time. [GH-11650] * secrets/database: Fix marshalling to allow providing numeric arguments to external database plugins. [GH-11451] * secrets/database: Fixes issue for V4 database interface where SetCredentials wasn't falling back to using RotateRootCredentials if SetCredentials is Unimplemented [GH-11585] * ui: Fix namespace-bug on login [GH-11182] v1.6.4: April 21, 2021 Release vault v1.6.4 v1.6.3 February 25, 2021 SECURITY: * Limited Unauthenticated License Read: We addressed a security vulnerability that allowed for the unauthenticated reading of Vault licenses from DR Secondaries. This vulnerability affects Vault and Vault Enterprise and is fixed in 1.6.3 (CVE-2021-27668). CHANGES: * secrets/mongodbatlas: Move from whitelist to access list API [GH-10966] IMPROVEMENTS: * ui: Clarify language on usage metrics page empty state [GH-10951] BUG FIXES: * auth/kubernetes: Cancel API calls to TokenReview endpoint when request context is closed [GH-10930] * core/identity: Fix deadlock in entity merge endpoint. [GH-10877] * quotas: Fix duplicate quotas on performance standby nodes. [GH-10855] * quotas/rate-limit: Fix quotas enforcing old rate limit quota paths [GH-10689] replication (enterprise): Don't write request count data on DR Secondaries. * Fixes DR Secondaries becoming out of sync approximately every 30s. [GH-10970] * secrets/azure (enterprise): Forward service principal credential creation to the primary cluster if called on a performance standby or performance secondary. [GH-10902]
2021-05-30security/ruby-oauth: update to 0.5.6taca3-8/+9
0.5.6 (2021-04-02) * Add metadata to Gemspec file * Change default timeout to be the same as Net::HTTP default, 60 seconds instead of 30 seconds. * Add support for PUT requests with Action Controller (#181)
2021-05-30security/ruby-nexpose: update to 7.3.0taca3-8/+22
pkgsrc change: add "USE_LANGUAGES= # empty" line. 7.3.0 (2021-04-02) Fixed bugs: * Login Failed when update nexpose-client 2.0.2 to 7.2.1 #324 Closed issues: * Stuck on maintenance mode page #327 * job failure in servicenow #323 * [QUESTION] How to generate Shared Secret via RESTful API? #322 * XML::VulnerabilityDetail/Complete API missing an instances value for vulnerabilities #306 Merged pull requests: * Add a new privilege ManageAdvPolicies #330 (jinq102030) * Fix HostOrIP for Ruby 2.6.3 #328 (abunn-r7) * Fix travis builds #326 (gschneider-r7) * Migrate eso-client to nexpose-client / CSRF header update #309 (hwilson-r7)
2021-05-30security/ruby-metasploit_payloads-mettle: really update to 1.0.9taca2-7/+7
Really update to 1.0.9, previous commit was 1.0.8.
2021-05-30security/ruby-metasploit_payloads-mettle: update to 1.0.9taca2-7/+7
Quote from commit logs: 1.0.7 (2021-03-22) * Land #210, fix segfault on large tlv buffers 1.0.8 (2021-03-24) * Land #211, add fs_search to mettle 1.0.9 (2021-04-08) * Land #212, update dependencies and fix libeio
2021-05-30security/ruby-metasploit-payloads: update to 2.0.46taca2-7/+7
Quote from commit logs: 2.0.40 (2021-03-30) * Land #480, Fix #479, fix python meterpreter resolve command 2.0.41 (2021-03-31) * Land #481, fix request_fs_ls on inaccessible file 2.0.42 (2021-04-11) * Add stdapi_net_resolve_host(s) support to the PHP meterpreter * Land #483 - Avoid old PHP array indexing syntax 2.0.43 (2021-04-12) * Land #482, add stdapi_net_resolve_hosts to php meterpreter 2.0.44 (2021-04-28) * Land #484, Add stdapi_net_resolve_host(s) for Java 2.0.45 (2021-04-30) * Land #486, fix python meterpreter http transport comm timeout 2.0.46 (2021-05-10) * Land #488, fix HttpUserAgent on java/android
2021-05-30security/ruby-metasploit-model: update to 4.0.2taca3-11/+10
Quote from commit logs: 4.0.2 (2021-05-05) * Land #60, Add ruby 3.0 tests 4.0.1 (2021-04-29) * Land #59, Remove bundle cache 4.0.0 (2021-04-28) * Land #57, update to Rails 6.x compatible * update schema comment for automation 3.1.4 (2021-04-28) * and #58, Replaces travis with GH actions for testing
2021-05-30security/ruby-metasploit-concern: update to 4.0.2taca3-9/+9
Quote from commit logs: 4.0.2 (2021-05-05) * Land #36, Add ruby 3.0 tests 4.0.1 (2021-04-29) * Land #35, Remove bundle cache 4.0.0 (2021-04-28) * Land #33, updates to support rails 6.x 3.0.2 (2021-04-28) * Land #34, Replace travis with gh actions
2021-05-30ssdeep: update to version 2.14.1khorben5-30/+30
** Version 2.14.1 - 7 Nov 2017 * Bug Fixes - Fixed a spelling error. - Made relative path mode on Win32 to work. ** Version 2.14 - 12 Sep 2017 * New Features - Optimizations to the fuzzy hashing engine. (hash generator can run as twice as fast and comparison can run 1.5 through 5 times faster [heavily depends on the data and platform] than the previous release) * Bug Fixes - Fixed issue when certain memory allocation is failed.
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-10 02:12:39 +0000