summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2017-06-08v4.1.1adam2-7/+7
New features: Allow passing prompt='consent' via the flow_from_clientsecrets
2017-06-08sortjnemeth1-2/+2
2017-06-07Simplify *yara packages.wiz6-34/+27
2017-06-07Package yara 3.6.1khorben3-12/+12
In the release notes: * BUGFIX: Stack overflow caused by uncontrolled recursiveness (CVE-2017-9304) * BUGFIX: pe.overlay.size was undefined if the PE didn't have an overlay. Now it's set to 0 in those cases. * BUGFIX: Fix initalization issue that could cause a crash if rules compiled with a 32bit yarac is used with a 64bit yara.
2017-06-07Package yara 3.6.0khorben3-12/+12
In the release notes: * .NET module (Wesley Shields) * New features for ELF module (Jacob Baines) * Fix endianness issues (Hilko Bengen) * Function yr_compiler_add_fd added to libyara * MAX_THREADS limit can be arbitrarily increased (Emerson R. Wiley) * Added --fail-on-warnings command-line option * Multiple bug fixes
2017-06-07Fix build with Perl 5.26.0ryoon10-5/+76
2017-06-07update to version 1.8.20p2spz2-7/+7
upstream changelog: 2017-05-31 Todd C. Miller <Todd.Miller@courtesan.com> * NEWS, configure, configure.ac: Sudo 1.8.20p2 [47836f4c9834] * src/ttyname.c: A command name may also contain newline characters so read /proc/self/stat until EOF. It is not legal for /proc/self/stat to contain embedded NUL bytes so treat the file as corrupt if we see any. With help from Qualys. This is not exploitable due to the /dev traversal changes in sudo 1.8.20p1 (thanks Solar!). [15a46f4007dd] 2017-05-30 Todd C. Miller <Todd.Miller@courtesan.com> * src/ttyname.c: Use /proc/self consistently on Linux. As far as I know, only AIX doesn't support /proc/self. [6f3d9816541b]
2017-06-06Fix build with Perl 5.26.0ryoon2-1/+14
2017-06-06Allow selecting gnupg version. Switch default to gnupg2.wiz2-3/+20
Bump PKGREVISION.
2017-06-06Allow choosing gnupg1, gnupg2, or gnupg21. Default to gnupg2. Bump PKGREVISION.wiz2-2/+20
2017-06-06Fix build with Perl 5.26.0ryoon2-1/+17
2017-06-06Set RUBY_VERSIONS_ACCEPTED correctly to fix scan failures.jperkin1-1/+3
2017-06-05Fix build with perl 5.26.0ryoon2-1/+17
2017-06-05Update ruby-oauth to 0.5.3taca3-36/+14
=== 0.5.3 2017-05-24 * Removing legacy scripts (James Pinto) * Fix #145 - broken CLI required loading active_support (James Pinto) === 0.5.2 2017-05-17 * Adding a development dependency that had not been mentioned (James Pinto) * Use assert_nil so as to silence a Minitest 6 deprecation warning (James Pinto) * Stop bundling tests files in the gem (Michal Papis) * Minor cleanup on tests (James Pinto) * TravisCI no longer needs libcurl-dev (James Pinto) * Nokogiri 1.7 does not accept Ruby 2.0 (James Pinto) * Upgrading to CodeClimate 1.0 (James Pinto) * Adding support to Ruby 2.4 and head (James Pinto) * Locking gemspec to Rails 4 so as to allow our next version for Rails 5 (James Pinto) * Fix #113 adding paths when a full URL has been specified (James Pinto) * moving development dependency to gemspec (James Pinto) * Silencing 'Net::HTTPResponse#header is obsolete' (James Pinto) * Silencing some test warnings (James Pinto) * Silencing 'loading in progress, circular require considered harmful' (James Pinto) * Silence 'URI.escape obsolete' (James Pinto) * Refactored CLI (James Pinto) * Bug Fix, webmock 2.0 has introduced a new bug (James Pinto) * Moving test files into test/units/ (James Pinto) * Adding CodeClimate (James Pinto) * Reimplementing #82 - Debug Output Option (James Pinto) * Making a test/support dir (James Pinto) * Fix #177 - Adjusting to webmock latest recommended implementation for minitest (James Pinto) * Adding support to Ruby 2.4 and head (James Pinto) * Upgrading to CodeClimate 1.0 (James Pinto) * Nokogiri 1.7 does not accept Ruby 2.0 (James Pinto)
2017-06-05Recursive revbump from lang/perl5 5.26.0ryoon87-152/+174
2017-06-05Restrict ruby's version to 22 and 23.taca1-1/+3
2017-06-02Relax patten in GEM_CLEANBUILD.taca1-2/+2
2017-06-01Use public SHLIB_TYPE instead of private _OPSYS_SHLIB_TYPE.jlam1-2/+2
2017-06-01sortjnemeth1-2/+2
2017-05-31rework the link stage in the Makefile to specify -lgcrypt after all theagc2-7/+8
object files, in an attempt to fix undefined references to all libgcrypt functions in Linux bulk build
2017-05-31make sure __UNCONST is defined before using itagc1-0/+4
2017-05-31Fix exec command by adding the missing "$@" to pass down arguments.jym2-2/+3
Bump rev. Caught by wizd(8), thanks!
2017-05-31For unknown reason the program fails silently when called with open(1)jym1-1/+1
on latest Sierra. So exec the program directly instead of using open(1).
2017-05-31Hook pinentry-mac to the build.jym1-1/+2
2017-05-31Initial import of pinentry-mac, version 0.9.4.jym5-0/+62
This is a Darwin-ported pinentry, which works natively without pulling in gtk or qt4 dependencies. It is independent from the original collection of pinentry tools, and grew its own code and repository, although it still uses Assuan protocol internally (and can therefore be integrated with gpg-agent and enigmail under Mac OS). Note that it uses xcodebuild instead of autotools and generates an App. I decided to copy over the .app as under libexec and rely on sh script for invocation, App cannot be called through symlinks. Description: This is a collection of simple PIN or passphrase entry dialogs which utilize the Assuan protocol as described by the aegypten project. It provides programs for several graphical toolkits, such as GTK+ and QT, as well as for the console, using curses. This package is a port of the pinentry tool for Darwin.
2017-05-31Update security/openssh to 7.5p1.jperkin4-70/+18
Potentially-incompatible changes ================================ This release includes a number of changes that may affect existing configurations: * This release deprecates the sshd_config UsePrivilegeSeparation option, thereby making privilege separation mandatory. Privilege separation has been on by default for almost 15 years and sandboxing has been on by default for almost the last five. * The format of several log messages emitted by the packet code has changed to include additional information about the user and their authentication state. Software that monitors ssh/sshd logs may need to account for these changes. For example: Connection closed by user x 1.1.1.1 port 1234 [preauth] Connection closed by authenticating user x 10.1.1.1 port 1234 [preauth] Connection closed by invalid user x 1.1.1.1 port 1234 [preauth] Affected messages include connection closure, timeout, remote disconnection, negotiation failure and some other fatal messages generated by the packet code. * [Portable OpenSSH only] This version removes support for building against OpenSSL versions prior to 1.0.1. OpenSSL stopped supporting versions prior to 1.0.1 over 12 months ago (i.e. they no longer receive fixes for security bugs). Changes since OpenSSH 7.4 ========================= This is a bugfix release. Security -------- * ssh(1), sshd(8): Fix weakness in CBC padding oracle countermeasures that allowed a variant of the attack fixed in OpenSSH 7.3 to proceed. Note that the OpenSSH client disables CBC ciphers by default, sshd offers them as lowest-preference options and will remove them by default entriely in the next release. Reported by Jean Paul Degabriele, Kenny Paterson, Martin Albrecht and Torben Hansen of Royal Holloway, University of London. * sftp-client(1): [portable OpenSSH only] On Cygwin, a client making a recursive file transfer could be maniuplated by a hostile server to perform a path-traversal attack. creating or modifying files outside of the intended target directory. Reported by Jann Horn of Google Project Zero. New Features ------------ * ssh(1), sshd(8): Support "=-" syntax to easily remove methods from algorithm lists, e.g. Ciphers=-*cbc. bz#2671 Bugfixes -------- * sshd(1): Fix NULL dereference crash when key exchange start messages are sent out of sequence. * ssh(1), sshd(8): Allow form-feed characters to appear in configuration files. * sshd(8): Fix regression in OpenSSH 7.4 support for the server-sig-algs extension, where SHA2 RSA signature methods were not being correctly advertised. bz#2680 * ssh(1), ssh-keygen(1): Fix a number of case-sensitivity bugs in known_hosts processing. bz#2591 bz#2685 * ssh(1): Allow ssh to use certificates accompanied by a private key file but no corresponding plain *.pub public key. bz#2617 * ssh(1): When updating hostkeys using the UpdateHostKeys option, accept RSA keys if HostkeyAlgorithms contains any RSA keytype. Previously, ssh could ignore RSA keys when only the ssh-rsa-sha2-* methods were enabled in HostkeyAlgorithms and not the old ssh-rsa method. bz#2650 * ssh(1): Detect and report excessively long configuration file lines. bz#2651 * Merge a number of fixes found by Coverity and reported via Redhat and FreeBSD. Includes fixes for some memory and file descriptor leaks in error paths. bz#2687 * ssh-keyscan(1): Correctly hash hosts with a port number. bz#2692 * ssh(1), sshd(8): When logging long messages to stderr, don't truncate "\r\n" if the length of the message exceeds the buffer. bz#2688 * ssh(1): Fully quote [host]:port in generated ProxyJump/-J command- line; avoid confusion over IPv6 addresses and shells that treat square bracket characters specially. * ssh-keygen(1): Fix corruption of known_hosts when running "ssh-keygen -H" on a known_hosts containing already-hashed entries. * Fix various fallout and sharp edges caused by removing SSH protocol 1 support from the server, including the server banner string being incorrectly terminated with only \n (instead of \r\n), confusing error messages from ssh-keyscan bz#2583 and a segfault in sshd if protocol v.1 was enabled for the client and sshd_config contained references to legacy keys bz#2686. * ssh(1), sshd(8): Free fd_set on connection timeout. bz#2683 * sshd(8): Fix Unix domain socket forwarding for root (regression in OpenSSH 7.4). * sftp(1): Fix division by zero crash in "df" output when server returns zero total filesystem blocks/inodes. * ssh(1), ssh-add(1), ssh-keygen(1), sshd(8): Translate OpenSSL errors encountered during key loading to more meaningful error codes. bz#2522 bz#2523 * ssh-keygen(1): Sanitise escape sequences in key comments sent to printf but preserve valid UTF-8 when the locale supports it; bz#2520 * ssh(1), sshd(8): Return reason for port forwarding failures where feasible rather than always "administratively prohibited". bz#2674 * sshd(8): Fix deadlock when AuthorizedKeysCommand or AuthorizedPrincipalsCommand produces a lot of output and a key is matched early. bz#2655 * Regression tests: several reliability fixes. bz#2654 bz#2658 bz#2659 * ssh(1): Fix typo in ~C error message for bad port forward cancellation. bz#2672 * ssh(1): Show a useful error message when included config files can't be opened; bz#2653 * sshd(8): Make sshd set GSSAPIStrictAcceptorCheck=yes as the manual page (previously incorrectly) advertised. bz#2637 * sshd_config(5): Repair accidentally-deleted mention of %k token in AuthorizedKeysCommand; bz#2656 * sshd(8): Remove vestiges of previously removed LOGIN_PROGRAM; bz#2665 * ssh-agent(1): Relax PKCS#11 whitelist to include libexec and common 32-bit compatibility library directories. * sftp-client(1): Fix non-exploitable integer overflow in SSH2_FXP_NAME response handling. * ssh-agent(1): Fix regression in 7.4 of deleting PKCS#11-hosted keys. It was not possible to delete them except by specifying their full physical path. bz#2682 Portability ----------- * sshd(8): Avoid sandbox errors for Linux S390 systems using an ICA crypto coprocessor. * sshd(8): Fix non-exploitable weakness in seccomp-bpf sandbox arg inspection. * ssh(1): Fix X11 forwarding on OSX where X11 was being started by launchd. bz#2341 * ssh-keygen(1), ssh(1), sftp(1): Fix output truncation for various that contain non-printable characters where the codeset in use is ASCII. * build: Fix builds that attempt to link a kerberised libldns. bz#2603 * build: Fix compilation problems caused by unconditionally defining _XOPEN_SOURCE in wide character detection. * sshd(8): Fix sandbox violations for clock_gettime VSDO syscall fallback on some Linux/X32 kernels. bz#2142
2017-05-31Changes 1.9:adam3-9/+11
BACKWARDS INCOMPATIBLE: Elliptic Curve signature verification no longer returns True on success. This brings it in line with the interface's documentation, and our intent. The correct way to use :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey.verify` has always been to check whether or not :class:`~cryptography.exceptions.InvalidSignature` was raised. BACKWARDS INCOMPATIBLE: Dropped support for macOS 10.7 and 10.8. BACKWARDS INCOMPATIBLE: The minimum supported PyPy version is now 5.3. Python 3.3 support has been deprecated, and will be removed in the next cryptography release. Add support for providing tag during :class:`~cryptography.hazmat.primitives.ciphers.modes.GCM` finalization via :meth:`~cryptography.hazmat.primitives.ciphers.AEADDecryptionContext.finalize_with_tag`. Fixed an issue preventing cryptography from compiling against LibreSSL 2.5.x. Added :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey.key_size` and :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey.key_size` as convenience methods for determining the bit size of a secret scalar for the curve. Accessing an unrecognized extension marked critical on an X.509 object will no longer raise an UnsupportedExtension exception, instead an :class:`~cryptography.x509.UnrecognizedExtension` object will be returned. This behavior was based on a poor reading of the RFC, unknown critical extensions only need to be rejected on certificate verification. The CommonCrypto backend has been removed. MultiBackend has been removed. Whirlpool and RIPEMD160 have been deprecated.
2017-05-31sudo: include the full regen of configure script.maya2-3/+27
I tried to exclude a hunk that seemed new, but that is probably wrong. It didn't cause problems on my end at first, but does fail for others.
2017-05-31sudo: workaround deficiencies in netbsd 6,7maya2-1/+22
NetBSD 7 doesn't define WCONTINUED or WIFCONTINUED, so provide failure fallback definitions. Thanks nonaka for the heads up.
2017-05-30Add patch to resolve gpgsm S/MIME failuresgdt3-2/+68
S/MIME messages encrypted with gpgsm are sometimes not decodable by other implementations. Discussion on gnupg-devel indicates that gpg (via libksba) is incorrectly dropping leading zeros from the encrypted session key. This commit adds a patch by Daiki Ueno from the mailinglist that appears to improve interoperability. Upstream has not yet applied it, but also has not said that it is wrong.
2017-05-30sudo: update to 1.8.20p1.maya6-52/+90
Fixes CVE-2017-1000367, local privilege escalation on linux. What's new in Sudo 1.8.20p1 * Fixed "make check" when using OpenSSL or GNU crypt. Bug #787. * Fixed CVE-2017-1000367, a bug parsing /proc/pid/stat on Linux when the process name contains spaces. Since the user has control over the command name, this could potentially be used by a user with sudo access to overwrite an arbitrary file on systems with SELinux enabled. Also stop performing a breadth-first traversal of /dev when looking for the device; only a hard-coded list of directories are checked, What's new in Sudo 1.8.20 * Added support for SASL_MECH in ldap.conf. Bug #764 * Added support for digest matching when the command is a glob-style pattern or a directory. Previously, only explicit path matches supported digest checks. * New "fdexec" Defaults option to control whether a command is executed by path or by open file descriptor. * The embedded copy of zlib has been upgraded to version 1.2.11. * Fixed a bug that prevented sudoers include files with a relative path starting with the letter 'i' from being opened. Bug #776. * Added support for command timeouts in sudoers. The command will be terminated if the timeout expires. * The SELinux role and type are now displayed in the "sudo -l" output for the LDAP and SSSD backends, just as they are in the sudoers backend. * A new command line option, -T, can be used to specify a command timeout as long as the user-specified timeout is not longer than the timeout specified in sudoers. This option may only be used when the "user_command_timeouts" flag is enabled in sudoers. * Added NOTBEFORE and NOTAFTER command options to the sudoers backend similar to what is already available in the LDAP backend. * Sudo can now optionally use the SHA2 functions in OpenSSL or GNU crypt instead of the SHA2 implementation bundled with sudo. * Fixed a compilation error on systems without the stdbool.h header file. Bug #778. * Fixed a compilation error in the standalone Kerberos V authentication module. Bug #777. * Added the iolog_flush flag to sudoers which causes I/O log data to be written immediately to disk instead of being buffered. * I/O log files are now created with group ID 0 by default unless the "iolog_user" or "iolog_group" options are set in sudoers. * It is now possible to store I/O log files on an NFS-mounted file system where uid 0 is remapped to an unprivileged user. The "iolog_user" option must be set to a non-root user and the top-level I/O log directory must exist and be owned by that user. * Added the restricted_env_file setting to sudoers which is similar to env_file but its contents are subject to the same restrictions as variables in the invoking user's environment. * Fixed a use after free bug in the SSSD backend when the fqdn sudoOption is enabled and no hostname value is present in /etc/sssd/sssd.conf. * Fixed a typo that resulted in a compilation error on systems where the killpg() function is not found by configure. * Fixed a compilation error with the included version of zlib when sudo was built outside the source tree. * Fixed the exit value of sudo when the command is terminated by a signal other than SIGINT. This was broken in sudo 1.8.15 by the fix for Bug #722. Bug #784. * Fixed a regression introduced in sudo 1.8.18 where the "lecture" option could not be used in a positive boolean context, only a negative one. * Fixed an issue where sudo would consume stdin if it was not connected to a tty even if log_input is not enabled in sudoers. Bug #786. * Clarify in the sudoers manual that the #includedir directive diverts control to the files in the specified directory and, when parsing of those files is complete, returns control to the original file. Bug #775. What's new in Sudo 1.8.19p2 * Fixed a crash in visudo introduced in sudo 1.8.9 when an IP address or network is used in a host-based Defaults entry. Bug #766 * Added a missing check for the ignore_iolog_errors flag when the sudoers plugin generates the I/O log file path name. * Fixed a typo in sudo's vsyslog() replacement that resulted in garbage being logged to syslog. What's new in Sudo 1.8.19p1 * Fixed a bug introduced in sudo 1.8.19 that resulted in the wrong syslog priority and facility being used. What's new in Sudo 1.8.19 * New "syslog_maxlen" Defaults option to control the maximum size of syslog messages generated by sudo. * Sudo has been run against PVS-Studio and any issues that were not false positives have been addressed. * I/O log files are now created with the same group ID as the parent directory and not the invoking user's group ID. * I/O log permissions and ownership are now configurable via the "iolog_mode", "iolog_user" and "iolog_group" sudoers Defaults variables. * Fixed configuration of the sudoers I/O log plugin debug subsystem. Previously, I/O log information was not being written to the sudoers debug log. * Fixed a bug in visudo that broke editing of files in an include dir that have a syntax error. Normally, visudo does not edit those files, but if a syntax error is detected in one, the user should get a chance to fix it. * Warnings about unknown or unparsable sudoers Defaults entries now include the file and line number of the problem. * Visudo will now use the file and line number information about an unknown or unparsable Defaults entry to go directly to the file with the problem. * Fixed a bug in the sudoers LDAP back-end where a negated sudoHost entry would prevent other sudoHost entries following it from matching. * Warnings from visudo about a cycle in an Alias entry now include the file and line number of the problem. * In strict mode, visudo will now use the file and line number information about a cycle in an Alias entry to go directly to the file with the problem. * The sudo_noexec.so file is now linked with -ldl on systems that require it for the wordexp() wrapper. * Fixed linking of sudo_noexec.so on macOS systems where it must be a dynamic library and not a module. * Sudo's "make check" now includes a test for sudo_noexec.so working. * The sudo front-end now passes the user's umask to the plugin. Previously the plugin had to determine this itself. * Sudoreplay can now display the stdin and ttyin streams when they are explicitly added to the filter list. * Fixed a bug introduced in sudo 1.8.17 where the "all" setting for verifypw and listpw was not being honored. Bug #762. * The syslog priority (syslog_goodpri and syslog_badpri) can now be negated or set to "none" to disable logging of successful or unsuccessful sudo attempts via syslog. What's new in Sudo 1.8.18p1 * When sudo_noexec.so is used, the WRDE_NOCMD flag is now added if the wordexp() function is called. This prevents commands from being run via wordexp() without disabling it entirely. * On Linux systems, sudo_noexec.so now uses a seccomp filter to disable execute access if the kernel supports seccomp. This is more robust than the traditional method of using stub functions that return an error. What's new in Sudo 1.8.18 * The sudoers locale is now set before parsing the sudoers file. If sudoers_locale is set in sudoers, it is applied before evaluating other Defaults entries. Previously, sudoers_locale was used when evaluating sudoers but not during the inital parse. Bug #748. * A missing or otherwise invalid #includedir is now ignored instead of causing a parse error. * During "make install", backup files are only used on HP-UX where it is not possible to unlink a shared object that is in use. This works around a bug in ldconfig on Linux which could create links to the backup shared library file instead of the current one. * Fixed a bug introduced in 1.8.17 where sudoers entries with long commands lines could be truncated, preventing a match. Bug #752. * The fqdn, runas_default and sudoers_locale Defaults settings are now applied before any other Defaults settings since they can change how other Defaults settings are parsed. * On systems without the O_NOFOLLOW open(2) flag, when the NOFOLLOW flag is set, sudoedit now checks whether the file is a symbolic link before opening it as well as after the open. Bug #753. * Sudo will now only resolve a user's group IDs to group names when sudoers includes group-based permissions. Group lookups can be expensive on some systems where the group database is not local. * If the file system holding the sudo log file is full, allow the command to run unless the new ignore_logfile_errors Defaults option is disabled. Bug #751. * The ignore_audit_errors and ignore_iolog_errors Defaults options have been added to control sudo's behavior when it is unable to write to the audit and I/O logs. * Fixed a bug introduced in 1.8.17 where the SIGPIPE signal handler was not being restored when sudo directly executes the command. * Fixed a bug where "sudo -l command" would indicate that a command was runnable even when denied by sudoers when using the LDAP or SSSD backends. * The match_group_by_gid Defaults option has been added to allow sites where group name resolution is slow and where sudoers only contains a small number of groups to match groups by group ID instead of by group name. * Fixed a bug on Linux where a 32-bit sudo binary could fail with an "unable to allocate memory" error when run on a 64-bit system. Bug #755 * When parsing ldap.conf, sudo will now only treat a '#' character as the start of a comment when it is at the beginning of the line. * Fixed a potential crash when auditing is enabled and the audit function fails with an error. Bug #756 * Norwegian Nynorsk translation for sudo from translationproject.org. * Fixed a typo that broke short host name matching when the fqdn flag is enabled in sudoers. Bug #757 * Negated sudoHost attributes are now supported by the LDAP and SSSD backends. * Fixed matching entries in the LDAP and SSSD backends when a RunAsGroup is specified but no RunAsUser is present. * Fixed "sudo -l" output in the LDAP and SSSD backends when a RunAsGroup is specified but no RunAsUser is present.
2017-05-30Stop using RUBY_JSON_{REQD,TYPE} since all ruby2*-base pacakges containtaca1-4/+1
required version of json extension.
2017-05-30Update security/py-certbot to 0.14.2.fhajny2-7/+7
0.14.2 - Certbot 0.14.0 included a bug where Certbot would create a temporary log file (usually in /tmp) if the program exited during argument parsing. 0.14.1 - Certbot now works with configargparse 0.12.0. - Issues with the Apache plugin and Augeas 1.7+ have been resolved. - A problem where the Nginx plugin would fail to install certificates on systems that had the plugin's SSL/TLS options file from 7+ months ago has been fixed.
2017-05-29Comment out py-requests test dependency to fix cyclic dependencywiz1-2/+3
with py-requests-2.16.x.
2017-05-29Explain use of PTHREAD_AUTO_VARSgdt1-1/+4
Upstream's makefile is missing PTHREAD vars in the rules for parse.
2017-05-29Updated py-cryptography to 1.8.2.wiz2-7/+7
1.8.2 - 2017-05-26 ~~~~~~~~~~~~~~~~~~ * Fixed a compilation bug affecting OpenSSL 1.1.0f. * Updated Windows and macOS wheels to be compiled against OpenSSL 1.1.0f.
2017-05-29Updated py-service_identity to 17.0.0.wiz3-9/+11
17.0.0 (2017-05-23) ------------------- Deprecations: ^^^^^^^^^^^^^ - Since Chrome 58 and Firefox 48 both don't accept certificates that contain only a Common Name, its usage is hereby deprecated in ``service_identity`` too. We have been raising a warning since 16.0.0 and the support will be removed in mid-2018 for good. Changes: ^^^^^^^^ - When ``service_identity.SubjectAltNameWarning`` is raised, the Common Name of the certificate is now included in the warning message. `#17 <https://github.com/pyca/service_identity/pull/17>`_ - Added ``cryptography.x509`` backend for verifying certificates. `#18 <https://github.com/pyca/service_identity/pull/18>`_ - Wildcards (``*``) are now only allowed if they are the leftmost label in a certificate. This is common practice by all major browsers. `#19 <https://github.com/pyca/service_identity/pull/19>`_
2017-05-29Changes 2017.4.17:adam2-7/+7
Unknown
2017-05-28security/ccid: include pthread related flags in CFLAGS & co.rumko1-1/+3
At least on fbsd, it won't compile due to not linking to the pthread libraries. Bump PKGREVISION just in case. Ok@ gdt
2017-05-26Changes 1.8.2:adam2-7/+7
Bug fixes.
2017-05-25Handle _XOPEN_SOURCE correctly on SunOS.jperkin3-1/+41
2017-05-25Update crudesaml to 1.8manu5-32/+11
Changelog since previous version in pkgsrc crusdesaml-1.8 2017-05-26 Fix crash introduced server side in 1.6 for saml_log() crusdesaml-1.7 2017-05-22 Only iterate on XML_ELEMENT_NODE nodes crusdesaml-1.6 2017-05-20 Typos in man pages (Florian Best) Don't log the password length if it is too small (Florian Best) Stop if wxmlXPathRegisterNs failed (Florian Best) autoconf: Remove duplicate $(DESTDIR) (Florian Best) PAM: Require only one provider (Florian Best) PAM: No SONAME versioning (Philipp Hahn) autoconf: Only strictness foreign (Philipp Hahn) PAM: fix static PAM module build (Philipp Hahn) Hide internal symbols (Philipp Hahn) Fix varadic function SIGSEGV (Philipp Hahn) Fix crash when using saml_log()/saml_error() in SASL client plugin crusdesaml-1.5 2012-11-13 mod_shib2 compatibility, debug messages (Jan Tomasek)
2017-05-21Remove unnecessary RCD_SCRIPT_WRK.<script> definitions.jlam1-3/+1
RCD_SCRIPT_WRK.<script> was set previously to prevent a name conflict with ${WRKSRC} because in the past, it defaulted to ${WRKDIR}/<script>. This has since been changed to default to ${WRKDIR}/.rc.d/<script> to prevent unintended name collisions, which makes this definition no longer needed.
2017-05-19Upgrade py-paramiko from 1.15.3 to 1.18.2.he3-8/+9
Pkgsrc changes: Adapt PLIST. Upstream changes: 1.18.2 2017-02-20 [Bug] #895: Fix a bug in server-mode concerning multiple interactive auth steps (which were incorrectly responded to). Thanks to Dennis Kaarsemaker for catch & patch. [Bug] #713: (via #714 and #889) Don't pass initialization vectors to PyCrypto when dealing with counter-mode ciphers; newer PyCrypto versions throw an exception otherwise (older ones simply ignored this parameter altogether). Thanks to @jmh045000 for report & patches. [Bug] #44: (via #891) SSHClient now gives its internal Transport a handle on itself, preventing garbage collection of the client until the session is closed. Without this, some code which returns stream or transport objects without the client that generated them, would result in premature session closure when the client was GCd. Credit: @w31rd0 for original report, Omer Anson for the patch. [Bug] #862: (via #863) Avoid test suite exceptions on platforms lacking errno.ETIME (which seems to be some FreeBSD and some Windows environments.) Thanks to Sofian Brabez. [Bug] #853: Tweak how RSAKey.__str__ behaves so it doesn't cause TypeError under Python 3. Thanks to Francisco Couzo for the report. [Support] #866: (also #838) Remove an old test-related file we don't support, and add PyPy to Travis-CI config. Thanks to Pierce Lopez for the final patch and Pedro Rodrigues for an earlier edition. 1.18.1 2016-12-12 [Bug] #859: (via #860) A tweak to the original patch implementing #398 was not fully applied, causing calls to invoke_shell to fail with AttributeError. This has been fixed. Patch credit: Kirk Byers. 1.18.0 2016-12-09 [Feature] #398: Add an environment dict argument to Client.exec_command (plus the lower level Channel.update_environment and Channel.set_environment_variable methods) which implements the env SSH message type. This means the remote shell environment can be set without the use of VARNAME=value shell tricks, provided the server's AcceptEnv lists the variables you need to set. Thanks to Philip Lorenz for the pull request. [Feature] #780: (also #779, and may help users affected by #520) Add an optional timeout parameter to Transport.start_client (and feed it the value of the configured connection timeout when used within SSHClient.) This helps prevent situations where network connectivity isn't timing out, but the remote server is otherwise unable to service the connection in a timely manner. Credit to @sanseihappa. [Support] #819: Document how lacking gmp headers at install time can cause a significant performance hit if you build PyCrypto from source. (Most system-distributed packages already have this enabled.) [Support] #854: Fix incorrect docstring/param-list for Transport.auth_gssapi_keyex so it matches the real signature. Caught by @Score_Under. [Support] #792: Minor updates to the README and demos; thanks to Alan Yee. [Support] #801: Skip a Unix-only test when on Windows; thanks to Gabi Davar. For pre-1.18.0 changes, see http://www.paramiko.org/changelog.html
2017-05-18Crypto++ 5.6.5adam7-98/+176
The 5.6.5 release was mostly a maintenance release. The release included two CVE fixes. The first, CVE-2016-7420, was a procedural finding due to external build systems failing to define NDEBUG for release builds. The gap was the project's failure to tell users to define NDEBUG. The second, CVE-2016-7544, was a potential memory corruption on Windows platforms when using Microsoft compilers due to use of _malloca and _freea. Due to CVE-2016-7420 and the possibility for an unwanted assert to egress data, users and distros are encouraged to recompile the library and all dependent programs.
2017-05-18Update to GnuTLS 3.5.12.he3-8/+18
Pkgsrc changes: Adapt PLIST. Upstream changes: * Version 3.5.12 (released 2017-05-11) ** libgnutls: enabled TCP Fast open for MacOSX. Patch by Tim Ruehsen. ** libgnutls: gnutls_x509_crt_check_hostname2() no longer matches IP addresses against DNS fields of certificate (CN or DNSname). The previous behavior was to tolerate some misconfigured servers, but that was non-standard and skipped any IP constraints present in higher level certificates. ** libgnutls: when converting to IDNA2008, fallback to IDNA2003 (i.e., transitional encoding) if the domain cannot be converted. That provides maximum compatibility with browsers like firefox that perform the same conversion. ** libgnutls: fix issue in RSA-PSK client callback which resulted in no username being sent to the peer. Patch by Nicolas Dufresne. ** libgnutls: fix regression causing stapled extensions in trust modules not to be considered. ** certtool: introduced the email_protection_key option. This option was introduced in documentation for certtool without an implementation of it. It is a shortcut for option 'key_purpose_oid = 1.3.6.1.5.5.7.3.4'. ** certtool: made printing of key ID and key PIN consistent between certificates, public keys, and private keys. That is the private key printing now uses the same format as the rest. ** gnutls-cli: introduced the --sni-hostname option. This allows overriding the hostname advertised to the peer. ** API and ABI modifications: No changes since last version. * Version 3.5.11 (released 2017-04-07) ** gnutls.pc: do not include libtool options into Libs.private. ** libgnutls: Fixed issue when rehandshaking without a client certificate in a session which initially used one. Reported by Frantisek Sumsal. ** libgnutls: Addressed read of 4 bytes past the end of buffer in OpenPGP certificate parsing. Issues found using oss-fuzz project and were fixed by Alex Gaynor: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=737 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=824 ** libgnutls: Introduced locks in gnutls_pkcs11_privkey_t structure access. That allows PKCS#11 operations such as signing to be performed with the same object from multiple threads. ** libgnutls: Added support for MacOSX key chain for obtaining trust store's root CA certificates. That is, gnutls_x509_trust_list_add_system_trust() and gnutls_certificate_set_x509_system_trust() will load the certificates from the key chain. That also means that we no longer check for a default trust store file in configure when building on MacOSX (unless explicitly asked to). Patch by David Caldwell. ** libgnutls: when disabling OpenPGP authentication, the resulting library is ABI compatible (with openpgp related functions being stubs that fail on invocation). ** API and ABI modifications: No changes since last version. * Version 3.5.10 (released 2017-03-06) ** gnutls.pc: do not include libidn2 in Requires.private. The libidn2 versions available do not include libidn2.pc, thus the inclusion was causing pkg-config issues. Instead we include -lidn2 in Libs.private when compile against libidn2. ** libgnutls: optimized access to subject alternative names (SANs) in parsed certificates. The previous implementation assumed a small number of SANs in a certificate, with repeated calls to ASN.1 decoding of the extension without any intermediate caching. That caused delays in certificates with a long list of names in functions such as gnutls_x509_crt_check_hostname(). With the current code, the SANs are parsed once on certificate import. Resolves gitlab issue #165. ** libgnutls: Addressed integer overflow resulting to invalid memory write in OpenPGP certificate parsing. Issue found using oss-fuzz project: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420 [GNUTLS-SA-2017-3A] ** libgnutls: Addressed read of 1 byte past the end of buffer in OpenPGP certificate parsing. Issue found using oss-fuzz project: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=391 ** libgnutls: Addressed crashes in OpenPGP certificate parsing, related to private key parser. No longer allow OpenPGP certificates (public keys) to contain private key sub-packets. Issue found using oss-fuzz project: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=354 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=360 [GNUTLS-SA-2017-3B] ** libgnutls: Addressed large allocation in OpenPGP certificate parsing, that could lead in out-of-memory condition. Issue found using oss-fuzz project, and was fixed by Alex Gaynor: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=392 [GNUTLS-SA-2017-3C] ** libgnutls: Print the key PIN value used by the HPKP protocol as per RFC7469 when printing certificate information. ** libgnutls: gnutls_ocsp_resp_verify_direct() and gnutls_ocsp_resp_verify() flags can be set from the gnutls_certificate_verify_flags enumeration. This allows the functions to pass the same flags available for certificates to the verification function (e.g., GNUTLS_VERIFY_DISABLE_TIME_CHECKS or GNUTLS_VERIFY_ALLOW_BROKEN). ** libgnutls: gnutls_store_commitment() can accept flag GNUTLS_SCOMMIT_FLAG_ALLOW_BROKEN. This is to allow the function to operate in applications which use SHA1 for example, after SHA1 is deprecated. ** certtool: No longer ignore the 'add_critical_extension' template option if the 'add_extension' option is not present. ** gnutls-cli: Added LMTP, POP3, NNTP, Sieve and PostgreSQL support to the starttls-proto command. Patch by Robert Scheck. ** API and ABI modifications: No changes since last version.
2017-05-16Fix CVE-2016-6129. Bump PKGREVISION to 3.snj3-3/+37
2017-05-16update dropbear to 2016.74. changes:snj5-40/+47
2016.74 - 21 July 2016 - Security: Message printout was vulnerable to format string injection. If specific usernames including "%" symbols can be created on a system (validated by getpwnam()) then an attacker could run arbitrary code as root when connecting to Dropbear server. A dbclient user who can control username or host arguments could potentially run arbitrary code as the dbclient user. This could be a problem if scripts or webpages pass untrusted input to the dbclient program. CVE-2016-7406 https://secure.ucc.asn.au/hg/dropbear/rev/b66a483f3dcb - Security: dropbearconvert import of OpenSSH keys could run arbitrary code as the local dropbearconvert user when parsing malicious key files CVE-2016-7407 https://secure.ucc.asn.au/hg/dropbear/rev/34e6127ef02e - Security: dbclient could run arbitrary code as the local dbclient user if particular -m or -c arguments are provided. This could be an issue where dbclient is used in scripts. CVE-2016-7408 https://secure.ucc.asn.au/hg/dropbear/rev/eed9376a4ad6 - Security: dbclient or dropbear server could expose process memory to the running user if compiled with DEBUG_TRACE and running with -v CVE-2016-7409 https://secure.ucc.asn.au/hg/dropbear/rev/6a14b1f6dc04 The security issues were reported by an anonymous researcher working with Beyond Security's SecuriTeam Secure Disclosure www.beyondsecurity.com/ssd.html - Fix port forwarding failure when connecting to domains that have both IPv4 and IPv6 addresses. The bug was introduced in 2015.68 - Fix 100% CPU use while waiting for rekey to complete. Thanks to Zhang Hui P for the patch 2016.73 - 18 March 2016 - Support syslog in dbclient, option -o usesyslog=yes. Patch from Konstantin Tokarev - Kill a proxycommand when dbclient exits, patch from Konstantin Tokarev - Option to exit when a TCP forward fails, patch from Konstantin Tokarev - New "-o" option parsing from Konstantin Tokarev. This allows handling some extra options in the style of OpenSSH, though implementing all OpenSSH options is not planned. - Fix crash when fallback initshells() is used, reported by Michael Nowak and Mike Tzou - Allow specifying commands eg "dropbearmulti dbclient ..." instead of symlinks - Various cleanups for issues found by a lint tool, patch from Francois Perrad - Fix tab indent consistency, patch from Francois Perrad - Fix issues found by cppcheck, reported by Mike Tzou - Use system memset_s() or explicit_bzero() if available to clear memory. Also make libtomcrypt/libtommath routines use that (or Dropbear's own m_burn()). - Prevent scp failing when the local user doesn't exist. Based on patch from Michael Witten. - Improved Travis CI test running, thanks to Mike Tzou - Improve some code that was flagged by Coverity and Fortify Static Code Analyzer 2016.72 - 9 March 2016 - Validate X11 forwarding input. Could allow bypass of authorized_keys command= restrictions, found by github.com/tintinweb. Thanks for Damien Miller for a patch. CVE-2016-3116 https://secure.ucc.asn.au/hg/dropbear/rev/a3e8389e01ff 2015.71 - 3 December 2015 - Fix "bad buf_incrpos" when data is transferred, broke in 2015.69 - Fix crash on exit when -p address:port is used, broke in 2015.68, thanks to Frank Stollenwerk for reporting and investigation - Fix building with only ENABLE_CLI_REMOTETCPFWD given, patch from Konstantin Tokarev - Fix bad configure script test which didn't work with dash shell, patch from Juergen Daubert, broke in 2015.70 - Fix server race condition that could cause sessions to hang on exit, https://github.com/robotframework/SSHLibrary/issues/128 2015.70 - 26 November 2015 - Fix server password authentication on Linux, broke in 2015.69 2015.69 - 25 November 2015 - Fix crash when forwarded TCP connections fail to connect (bug introduced in 2015.68) - Avoid hang on session close when multiple sessions are started, affects Qt Creator Patch from Andrzej Szombierski - Reduce per-channel memory consumption in common case, increase default channel limit from 100 to 1000 which should improve SOCKS forwarding for modern webpages - Handle multiple command line arguments in a single flag, thanks to Guilhem Moulin - Manpage improvements from Guilhem Moulin - Build fixes for Android from Mike Frysinger - Don't display the MOTD when an explicit command is run from Guilhem Moulin - Check curve25519 shared secret isn't zero 2015.68 - Saturday 8 August 2015 - Reduce local data copying for improved efficiency. Measured 30% increase in throughput for connections to localhost - Forwarded TCP ports connect asynchronously and try all available addresses (IPv4, IPv6, round robin DNS) - Fix all compile warnings, many patches from Gaël Portay Note that configure with -Werror may not be successful on some platforms (OS X) and some configuration options may still result in unused variable warnings. - Use TCP Fast Open on Linux if available. Saves a round trip at connection to hosts that have previously been connected. Needs a recent Linux kernel and possibly "sysctl -w net.ipv4.tcp_fastopen=3" Client side is disabled by default pending further compatibility testing with networks and systems. - Increase maximum command length to 9000 bytes - Free memory before exiting, patch from Thorsten Horstmann. Useful for Dropbear ports to embedded systems and for checking memory leaks with valgrind. Only partially implemented for dbclient. This is disabled by default, enable with DROPBEAR_CLEANUP in sysoptions.h - DROPBEAR_DEFAULT_CLI_AUTHKEY setting now always prepends home directory unless there is a leading slash (~ isn't treated specially) - Fix small ECC memory leaks - Tighten validation of Diffie-Hellman parameters, from Florent Daigniere of Matta Consulting. Odds of bad values are around 2**-512 -- improbable. - Twofish-ctr cipher is supported though disabled by default - Fix pre-authentication timeout when waiting for client SSH-2.0 banner, thanks to CL Ouyang - Fix null pointer crash with restrictions in authorized_keys without a command, patch from Guilhem Moulin - Ensure authentication timeout is handled while reading the initial banner, thanks to CL Ouyang for finding it. - Fix null pointer crash when handling bad ECC keys. Found by afl-fuzz 2015.67 - Wednesday 28 January 2015 - Call fsync() after generating private keys to ensure they aren't lost if a reboot occurs. Thanks to Peter Korsgaard - Disable non-delayed zlib compression by default on the server. Can be enabled if required for old clients with DROPBEAR_SERVER_DELAY_ZLIB - Default client key path ~/.ssh/id_dropbear - Prefer stronger algorithms by default, from Fedor Brunner. AES256 over 3DES Diffie-hellman group14 over group1 - Add option to disable CBC ciphers. - Disable twofish in default options.h - Enable sha2 HMAC algorithms by default, the code was already required for ECC key exchange. sha1 is the first preference still for performance. - Fix installing dropbear.8 in a separate build directory, from Like Ma - Allow configure to succeed if libtomcrypt/libtommath are missing, from Elan Ruusamäe - Don't crash if ssh-agent provides an unknown type of key. From Catalin Patulea - Minor bug fixes, a few issues found by Coverity scan 2014.66 - Thursday 23 October 2014 - Use the same keepalive handling behaviour as OpenSSH. This will work better with some SSH implementations that have different behaviour with unknown message types. - Don't reply with SSH_MSG_UNIMPLEMENTED when we receive a reply to our own keepalive message - Set $SSH_CLIENT to keep bash happy, patch from Ryan Cleere - Fix wtmp which broke since 2013.62, patch from Whoopie 2014.65 - Friday 8 August 2014 - Fix 2014.64 regression, server session hang on exit with scp (and probably others), thanks to NiLuJe for tracking it down - Fix 2014.64 regression, clock_gettime() error handling which broke on older Linux kernels, reported by NiLuJe - Fix 2014.64 regression, writev() could occassionally fail with EAGAIN which wasn't caught - Avoid error message when trying to set QoS on proxycommand or multihop pipes - Use /usr/bin/xauth, thanks to Mike Frysinger - Don't exit the client if the local user entry can't be found, thanks to iquaba 2014.64 - Sunday 27 July 2014 - Fix compiling with ECDSA and DSS disabled - Don't exit abruptly if too many outgoing packets are queued for writev(). Patch thanks to Ronny Meeus - The -K keepalive option now behaves more like OpenSSH's "ServerAliveInterval". If no response is received after 3 keepalives then the session is terminated. This will close connections faster than waiting for a TCP timeout. - Rework TCP priority setting. New settings are if (connecting || ptys || x11) tos = LOWDELAY else if (tcp_forwards) tos = 0 else tos = BULK Thanks to Catalin Patulea for the suggestion. - Improve handling of many concurrent new TCP forwarded connections, should now be able to handle as many as MAX_CHANNELS. Thanks to Eduardo Silva for reporting and investigating it. - Make sure that exit messages from the client are printed, regression in 2013.57 - Use monotonic clock where available, timeouts won't be affected by system time changes - Add -V for version 2014.63 - Wednesday 19 February 2014 - Fix ~. to terminate a client interactive session after waking a laptop from sleep. - Changed port separator syntax again, now using host^port. This is because IPv6 link-local addresses use %. Reported by Gui Iribarren - Avoid constantly relinking dropbearmulti target, fix "make install" for multi target, thanks to Mike Frysinger - Avoid getting stuck in a loop writing huge key files, reported by Bruno Thomsen - Don't link dropbearkey or dropbearconvert to libz or libutil, thanks to Nicolas Boos - Fix linking -lcrypt on systems without /usr/lib, thanks to Nicolas Boos - Avoid crash on exit due to cleaned up keys before last packets are sent, debugged by Ronald Wahl - Fix a race condition in rekeying where Dropbear would exit if it received a still-in-flight packet after initiating rekeying. Reported by Oliver Metz. This is a longstanding bug but is triggered more easily since 2013.57 - Fix README for ecdsa keys, from Catalin Patulea - Ensure that generated RSA keys are always exactly the length requested. Previously Dropbear always generated N+16 or N+15 bit keys. Thanks to Unit 193 - Fix DROPBEAR_CLI_IMMEDIATE_AUTH mode which saves a network round trip if the first public key succeeds. Still not enabled by default, needs more compatibility testing with other implementations. - Fix for port 0 forwarding in the client and port forwarding with Apache MINA SSHD. - Fix for bad system linux/pkt-sched.h header file with older Linux kernels, from Steve Dover - Fix signal handlers so that errno is saved, thanks to Erik Ahlén for a patch and Mark Wickham for independently spotting the same problem.
2017-05-16Updated gnupg21 to 2.1.21.wiz4-29/+8
Noteworthy changes in version 2.1.21 (2017-05-15) ------------------------------------------------- * gpg,gpgsm: Fix corruption of old style keyring.gpg files. This bug was introduced with version 2.1.20. Note that the default pubring.kbx format was not affected. * gpg,dirmngr: Removed the skeleton config file support. The system's standard methods for providing default configuration files should be used instead. * w32: The Windows installer now allows installion of GnuPG without Administrator permissions. * gpg: Fixed import filter property match bug. * scd: Removed Linux support for Cardman 4040 PCMCIA reader. * scd: Fixed some corner case bugs in resume/suspend handling. * Many minor bug fixes and code cleanup.
2017-05-15Set myself as the maintainerkhorben1-2/+2
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-16 06:56:44 +0000