summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2022-11-09Reset MAINTAINERjoerg2-4/+4
2022-11-09Update OpenDNSSEC2 to version 2.1.12.he3-12/+12
Pkgsrc changes: * Adapt patch, update checksums. Upstream changes: OpenDNSSEC 2.1.12 - 2022-11-08 * Ensure debug symbols on RPM-style builds. * Bug fix that prevented restoring state from when salt length was zero. * Bug fix for enforcer daemon crash after deleting key on some systems. OpenDNSSEC 2.1.11 - 2022-09-17 * Improper re-use of already used keys when using <SharedKeys/> as a consequence of previous bug in 2.1.6 * Improved reporting upon segmentation faults or similar aborts. * Fix for migration to resalt of length 0. * Fix for upstream nameserver, implementing IXFR but without support for IXFR for that specific zone and responding without AXFR. * Degraded log message key_update_failed because this action is retried.
2022-11-09py-certifi: updated to 2022.9.24adam3-8/+10
2022.9.24 Unknown changes
2022-11-09py-acme py-certbot*: updated to 1.32.0adam17-66/+66
1.32.0 - 2022-11-08 Changed * DNS RFC2136 module now uses the TSIG key to check for an authoritative SOA record. Helps the use of split-horizon and multiple views in BIND9 using the key in an ACL to determine which view to use. Fixed * CentOS 9 and other RHEL-derived OSes now correctly use httpd instead of apachectl for various Apache-related commands
2022-11-07security/sudo: update to 1.9.12p1taca3-48/+6
1.9.12p1 (2022-11-07) What's new in Sudo 1.9.12p1 * Sudo's configure script now does a better job of detecting when the -fstack-clash-protection compiler option does not work. GitHub issue #191. * Fixed CVE-2022-43995, a potential out-of-bounds write for passwords smaller than 8 characters when passwd authentication is enabled. This does not affect configurations that use other authentication methods such as PAM, AIX authentication or BSD authentication. * Fixed a build error with some configurations compiling host_port.c.
2022-11-05openssl: pkglint cleanupwiz1-11/+11
2022-11-05openssl: update to 1.1.1s.wiz3-7/+9
Major changes between OpenSSL 1.1.1r and OpenSSL 1.1.1s [1 Nov 2022] o Fixed a regression introduced in OpenSSL 1.1.1r not refreshing the certificate data to be signed before signing the certificate. Major changes between OpenSSL 1.1.1q and OpenSSL 1.1.1r [11 Oct 2022] o Added a missing header for memcmp that caused compilation failure on some platforms
2022-11-05security/signify: update to 0.12.pin3-12/+12
The version number is kept consistent with that of outils. Sources have been synced with upstream OpenBSD/src. Changes relevant to signify: - Unused variables moved under !VERIFYONLY - In -C mode, the public key is optional since it can be deduced from the untrusted comment. In this case, don't ignore -t but rather make it work as expected.
2022-11-05Import wip/gopass as security/gopass.nikita6-1/+979
Add gopass version 1.14.9, packaged by Iku Iwasa. gopass is a rewrite of the pass password manager in Go with the aim of making it cross-platform and adding additional features. Our target audience are professional developers and sysadmins (and especially teams of those) who are well versed with a command line interface. One explicit goal for this project is to make it more approachable to non-technical users. We go by the UNIX philosophy and try to do one thing and do it well, providing a stellar user experience and a sane, simple interface.
2022-11-04security/sudo: add fix for CVE-2022-43995taca3-2/+44
Add patch from upstream to fix CVE-2022-43995. Bump PKGREVISION.
2022-11-03security/pear-Crypt_GPG: utilize REPLACE_PHPtaca1-6/+3
Instead of using own REPLACE_INTERPRETER, use REPLACE_PHP.
2022-11-02Revbump all Go packages after go119 security updatebsiegert9-18/+18
2022-11-02Update to 3.5.2. From the changelog:schmonz2-6/+6
- tls_signer: Replace ECDSA_METHOD with EC_KEY_METHOD - doc: Note OpenSSL 3.0.0 compatibility in README From the upstream LibreSSL changelog for 3.5.0: * New Features - The RFC 3779 API was ported from OpenSSL. Many bugs were fixed, regression tests were added and the code was cleaned up. - Certificate Transparency was ported from OpenSSL. Many internal improvements were made, resulting in cleaner and safer code. Regress coverage was added. libssl does not yet make use of it. * Portable Improvements - Fixed various POSIX compliance and other portability issues found by the port to the Sortix operating system. - Add libmd as platform specific libraries for Solaris. Issue reported from (ihsan <at> opencsw org) on libressl ML. - Set IA-64 compiler flag only if it is HP-UX with IA-64. Suggested from Larkin Nickle (me <at> larbob org) by libressl ML. - Enabled and scheduled Coverity scan. Contributed by Ilya Shipitsin (chipitsine <at> gmail com> on github. * Compatibility Changes - Most structs that were previously defined in the following headers are now opaque as they are in OpenSSL 1.1: bio.h, bn.h, comp.h, dh.h, dsa.h, evp.h, hmac.h, ocsp.h, rsa.h, x509.h, x509v3.h, x509_vfy.h - Switch TLSv1.3 cipher names from AEAD- to OpenSSL's TLS_ OpenSSL added the TLSv1.3 ciphersuites with "RFC names" instead of using something consistent with the previous naming. Various test suites expect these names (instead of checking for the much more sensible cipher numbers). The old names are still accepted as aliases. - Subject alternative names and name constraints are now validated when they are added to certificates. Various interoperability problems with stacks that validate certificates more strictly than OpenSSL can be avoided this way. - Attempt to opportunistically use the host name for SNI in s_client * Bug fixes - In some situations, the verifier would discard the error on an unvalidated certificate chain. This would happen when the verification callback was in use, instructing the verifier to continue unconditionally. This could lead to incorrect decisions being made in software. - Avoid an infinite loop in SSL_shutdown() - Fix another return 0 bug in SSL_shutdown() - Handle zero byte reads/writes that trigger handshakes in the TLSv1.3 stack - A long standing memleak in libtls CRL handling was fixed * Internal Improvements - Cache the SHA-512 hash instead of the SHA-1 hash and cache notBefore and notAfter times when X.509 certificates are parsed. - The X.509 lookup code has been simplified and cleaned up. - Fixed numerous issues flagged by coverity and the cryptofuzz project - Increased the number of Miller-Rabin checks in DH and DSA key/parameter generation - Started using the bytestring API in libcrypto for cleaner and safer code - Convert {i2d,d2i}_{,EC_,DSA_,RSA_}PUBKEY{,_bio,_fp}() to templated ASN1 - Convert ASN1_OBJECT_new() to calloc() - Convert ASN1_STRING_type_new() to calloc() - Rewrite ASN1_STRING_cmp() - Use calloc() for X509_CRL_METHOD_new() instead of malloc() - Convert ASN1_PCTX_new() to calloc() - Replace asn1_tlc_clear and asn1_tlc_clear_nc macros with a function - Consolidate {d2i,i2d}_{pr,pu}.c - Remove handling of a NULL BUF_MEM from asn1_collect() - Pull the recursion depth check up to the top of asn1_collect() - Inline collect_data() in asn1_collect() - Convert asn1_d2i_ex_primitive()/asn1_collect() from BUF_MEM to CBB - Clean up d2i_ASN1_BOOLEAN() and i2d_ASN1_BOOLEAN() - Consolidate ASN.1 universal tag type data - Rewrite ASN.1 identifier/length parsing in CBS - Make OBJ_obj2nid() work correctly with NID_undef - tlsext_tick_lifetime_hint is now an uint32_t - Untangle ssl3_get_message() return values - Rename tls13_buffer to tls_buffer - Fold DTLS_STATE_INTERNAL into DTLS1_STATE - Provide a way to determine our maximum legacy version - Mop up enc_read_ctx and read_hash - Fold SSL_SESSION_INTERNAL into SSL_SESSION - Use ssl_force_want_read in the DTLS code - Add record processing limit to DTLS code - Add explicit CBS_contains_zero_byte() check in CBS_strdup() - Improve SNI hostname validation - Ensure SSL_set_tlsext_host_name() is given a valid hostname - Fix a strange check in the auto DH codepath - Factor out/rewrite DHE key exchange - Convert server serialisation of DHE parameters/public key to new functions - Check DH public key in ssl_kex_peer_public_dhe() - Move the minimum DHE key size check into ssl_kex_peer_params_dhe() - Clean up and refactor server side DHE key exchange - Provide CBS_get_last_u8() - Provide CBS_get_u64() - Provide CBS_add_u64() - Provide various CBS_peek_* functions - Use CBS_get_last_u8() to find the content type in TLSv1.3 records - unifdef TLS13_USE_LEGACY_CLIENT_AUTH - Correct SSL_get_peer_cert_chain() when used with the TLSv1.3 stack - Only allow zero length key shares when we know we're doing HRR - Pull key share group/length CBB code up from tls13_key_share_public() - Refactor ssl3_get_server_kex_ecdhe() to separate parsing and validation - Return 0 on failure from send/get kex functions in the legacy stack - Rename tls13_key_share to tls_key_share - Allocate and free the EVP_AEAD_CTX struct in tls13_record_protection - Convert legacy TLS client to tls_key_share - Convert legacy TLS server to tls_key_share - Stop attempting to duplicate the public and private key of dh_tmp - Rename dh_tmp to dhe_params - Rename CERT to SSL_CERT and CERT_PKEY to SSL_CERT_PKEY - Clean up pkey handling in ssl3_get_server_key_exchange() - Fix GOST skip certificate verify handling - Simplify tlsext_keyshare_server_parse() - Plumb decode errors through key share parsing code - Simplify SSL_get_peer_certificate() - Cleanup/simplify ssl_cert_type() - The S3I macro was removed - The openssl(1) cms and smime subcommands option handling was converted and the C source was cleaned up. * Documentation improvements - 45 new manual pages, most of which were written from scratch. Documentation coverage of ASN.1 and X.509 code has been significantly improved. Upstream 3.5.1 changelog: * A malicious certificate can cause an infinite loop. Reported by and fix from Tavis Ormandy and David Benjamin, Google. Upstream 3.5.2 changelog: This is the first stable release for the 3.5.x branch, as shipped with OpenBSD 7.1.
2022-11-02py-cryptography: updated to 38.0.3adam4-12/+12
38.0.3 - 2022-11-01 ~~~~~~~~~~~~~~~~~~~ * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.0.7, which resolves *CVE-2022-3602* and *CVE-2022-3786*. 38.0.2 - 2022-10-11 ~~~~~~~~~~~~~~~~~~~ This release was subsequently yanked from PyPI due to a regression in OpenSSL. * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.0.6.
2022-10-31py-google-auth-oauthlib: updated to 0.7.0adam2-7/+7
0.7.0 (2022-10-25) Bug Fixes setup.py: increase required google-auth version to >=2.13.0
2022-10-31py-nacl: not for Python 2.7adam1-6/+6
2022-10-30keepassxc: update to 2.7.4.wiz3-8/+9
## 2.7.4 (2022-10-29) ### Changes - Add 2 months expiration preset [#8687] - CLI: Add Unicode support on Windows [#8618] ### Fixes - Fix crash on macOS when unlocking database [#8676] - Fix display of passwords in preview panel [#8633] - Fix clicking links in entry preview panel [#8644] - Prevent expired entries search if no results returned [#8643] - Browser: Revert code causing connection problems [#8665] - Browser: Fix socket file symbolic link on Linux [#8656] - Flatpak: Fix launching browser proxy service [#8680] - SSH Agent: Fix paegent support on Windows [#8619] ## 2.7.3 (2022-10-23) ### Changes - Enhance Tags Support and Add Saved Searches [#8435, #8607] - Significant improvements to entry preview panel [#7993] - Add password strength indicator to all password fields [#7885] - Limit zxcvbn entropy estimation length to 128 characters [#7748] - Try full URL path when fetching favicon [#8565] - Hide usernames in preview panel when hidden in entry view [#8608] - Enable dark title bar on windows when accent color is not used [#8498] - Add option to display passwords in color in preview panel [#7097] - Add XML Export option to GUI [#8524] - Increase entropy required for a "good" password rating to 75 [#8523] - Add shortcut to copy password with TOTP appended [#8443] - Show entry count in status bar [#8435] - Allow KeePassXC to be built without X11 [#8147] - Enable use of VivoKey Apex and Dangerous Things FlexSecure tokens [#8332] - Add setting for number of recent files [#8239] - Add Ctrl+Tab shortcut to cycle databases in unlock dialog [#8168] - Replace offensive words in eff_large.wordlist [#7968] - Auto-Type: PICKCHARS can specify attribute and ignore BEEP [#8118] - Linux: Add isHardwareKeySupported and refreshHardwareKeys to DBus methods [#8055] - Add config variable to specify default database file name [#8042] - Support numeric aware sorting on Windows and macOS [#8363] - CLI: Add `db-edit` command [#8400] - CLI: Add option to display all attributes with `show` command [#8256] - CLI: Show UUID and tags with `show` and `clip` commands [#8241] - Browser: Move socket into separate directory on Linux [#8030] - Browser: Add group setting to omit WWW subdomain when matching URLs [#7988] - FdoSecrets: Ask to unlock the database when creating items [#8022, #8028] - FdoSecrets: Skip entries in recycle bin when searching [#8021] ### Fixes - Fix potential deadlock in UI when saving [#8606] - Fix newlines when copying notes from preview panel [#8542] - Fix dark mode detection on Linux [#8477] - Fix crash when deleting items in recycle bin while searching [#8117] - Fix crash when trying to close database during unlock [#8144] - Fix tabbing around the interface [#8435, #8520] - Fix OPVault import when there are multiple OTP fields [#8436] - Fix various Windows Hello bugs [#8354] - Fix use of Apple Watch for Quick Unlock [#8311] - Better handling of "Lock on Minimize" setting [#8202] - Check for write permission before entering portable mode [#8447] - Correct regex escape logic to prevent parse errors [#7778] - Normalize slashes and file case for last used databases [#7864, #7214] - Link ykcore against pthread [#7807] - Auto-Type: Fix menu entries in selection dialog on Windows [#7987] - Auto-Type: Fix use of modifiers under macOS [#8111] - CLI: Fix output when using clip with the -t flag [#8271] - Browser: Use asynchronous access confirm dialog [#8273] - Browser: Always send database locked/unlocked status [#8114]
2022-10-29Add ssh-audit.fcambus1-1/+2
2022-10-29security/ssh-audit: import ssh-audit-2.5.0.fcambus4-0/+136
ssh-audit is a tool for ssh server & client configuration auditing. Features: * SSH1 and SSH2 protocol server support * analyze SSH client configuration * grab banner, recognize device or software and OS, detect compression * gather key-exchange, host-key, encryption and MAC algorithms * output algorithm information (available since, removed/disabled, unsafe/weak/legacy, etc) * output algorithm recommendations (append or remove based on recognized software version) * output security information (related issues, assigned CVE list, etc) * analyze SSH version compatibility based on algorithm information * historical information from OpenSSH, Dropbear SSH and libssh * policy scans to ensure adherence to a hardened/standard configuration
2022-10-26*: bump PKGREVISION for libunistring shlib major bumpwiz16-29/+32
2022-10-26*: bump PKGREVISION for libunistring shlib major bumpwiz8-15/+16
2022-10-25py-google-auth-oauthlib: updated to 0.6.0adam2-6/+6
0.6.0 Features Update to allow for 3PI credentials Bug Fixes Add timeout to run_local_server when waiting for response Documentation Update readme to point to current docs url
2022-10-25py-google-auth: updated to 2.13.0adam3-20/+27
2.13.0 (2022-10-14) Features Adds new external account authorized user credentials Implement pluggable auth interactive mode Introduce the functionality to override token_uri in credentials Bug Fixes Adding one more pattern to relax the regex check for sts and impersonation url endpoints 2.12.0 (2022-09-26) Features Retry behavior Bug Fixes Modify RefreshError exception to use gcloud ADC command. Revert "Update token refresh threshold from 20 seconds to 5 minutes".
2022-10-25py-nacl: updated to 1.5.0adam3-9/+9
1.5.0 BACKWARDS INCOMPATIBLE: Removed support for Python 2.7 and Python 3.5. BACKWARDS INCOMPATIBLE: We no longer distribute manylinux1 wheels. Added manylinux2014, manylinux_2_24, musllinux, and macOS universal2 wheels (the latter supports macOS arm64). Update libsodium to 1.0.18-stable (July 25, 2021 release). Add inline type hints.
2022-10-25py-oauthlib: updated to 3.2.2adam2-6/+6
3.2.2 (2022-10-17) ------------------ OAuth2.0 Provider: * CVE-2022-36087
2022-10-24sudo: updated to 1.9.12adam3-8/+7
What's new in Sudo 1.9.12 * Fixed a bug in the ptrace-based intercept mode where the current working directory could include garbage at the end. * Fixed a compilation error on systems that lack the stdint.h header. * Fixed a bug when logging the command's exit status in intercept mode. The wrong command could be logged with the exit status. * For ptrace-based intercept mode, sudo will now attempt to verify that the command path name, arguments and environment have not changed from the time when they were authorized by the security policy. The new "intercept_verify" sudoers setting can be used to control this behavior. * Fixed running commands with a relative path (e.g. ./foo) in intercept mode. Previously, this would fail if sudo's current working directory was different from that of the command. * Sudo now supports passing the execve(2) system call the NULL pointer for the `argv` and/or `envp` arguments when in intercept mode. Linux treats a NULL pointer like an empty array. * The sudoers LDAP schema now allows sudoUser, sudoRunasUser and sudoRunasGroup to include UTF-8 characters, not just 7-bit ASCII. * Fixed a problem with "sudo -i" on SELinux when the target user's home directory is not searchable by sudo. * Neovim has been added to the list of visudo editors that support passing the line number on the command line. * Fixed a bug in sudo's SHA384 and SHA512 message digest padding. * Added a new "-N" (--no-update) command line option to sudo which can be used to prevent sudo from updating the user's cached credentials. It is now possible to determine whether or not a user's cached credentials are currently valid by running: $ sudo -Nnv and checking the exit value. One use case for this is to indicate in a shell prompt that sudo is "active" for the user. * PAM approval modules are no longer invoked when running sub-commands in intercept mode unless the "intercept_authenticate" option is set. There is a substantial performance penalty for calling into PAM for each command run. PAM approval modules are still called for the initial command. * Intercept mode on Linux now uses process_vm_readv(2) and process_vm_writev(2) if available. * The XDG_CURRENT_DESKTOP environment variable is now preserved by default. This makes it possible for graphical applications to choose the correct theme when run via sudo. * On 64-bit systems, if sudo fails to load a sudoers group plugin, it will use system-specific heuristics to try to locate a 64-bit version of the plugin. * The cvtsudoers manual now documents the JSON and CSV output formats. * Fixed a bug where sub-commands were not being logged to a remote log server when log_subcmds was enabled. * The new log_stdin, log_stdout, log_stderr, log_ttyin, and log_ttyout sudoers settings can be used to support more fine-grained I/O logging. The sudo front-end no longer allocates a pseudo-terminal when running a command if the I/O logging plugin requests logging of stdin, stdout, or stderr but not terminal input/output. * Quieted a libgcrypt run-time initialization warning. * Fixed a bug in visudo that caused literal backslashes to be removed from the EDITOR environment variable. * The sudo Python plugin now implements the "find_spec" method instead of the the deprecated "find_module". This fixes a test failure when a newer version of setuptools that doesn't include "find_module" is found on the system. * Fixed a bug introduced in sudo 1.9.9 where sudo_logsrvd created the process ID file, usually /var/run/sudo/sudo_logsrvd.pid, as a directory instead of a plain file. The same bug could result in I/O log directories that end in six or more X's being created literally in addition to the name being used as a template for the mkdtemp(3) function. * Fixed a long-standing bug where a sudoers rule with a command line argument of "", which indicates the command may be run with no arguments, would also match a literal "" on the command line. * Added the -I option to visudo which only edits the main sudoers file. Include files are not edited unless a syntax error is found. * Fixed "sudo -l -U otheruser" output when the runas list is empty. Previously, sudo would list the invoking user instead of the list user. * Fixed the display of command tags and options in "sudo -l" output when the RunAs user or group changes. A new line is started for RunAs changes which means we need to display the command tags and options again. * The sesh helper program now uses getopt_long(3) to parse the command line options. * The embedded copy of zlib has been updated to version 1.2.13. * Fixed a bug that prevented event log data from being sent to the log server when I/O logging was not enabled. This only affected systems without PAM or configurations where the pam_session and pam_setcred options were disabled in the sudoers file. * Fixed a bug where "sudo -l" output included a carriage return after the newline. This is only needed when displaying to a terminal in raw mode.
2022-10-20revision bump for qore 1.12.0nros3-5/+6
2022-10-20security/Makefile: sortwiz1-2/+2
2022-10-19fighting a losing battle against the py-cryptography rustification, part 5nia6-12/+15
Convert py-OpenSSL users to versioned_dependencies.mk
2022-10-19fighting a losing battle against the py-cryptography rustification, part 4nia1-0/+24
Add support for py-OpenSSL to versioned_dependencies.mk
2022-10-19fighting a losing battle against the py-cryptography rustification, part 3nia5-0/+95
Re-import the last version of py-OpenSSL without a hard unnecessary dependency on rustified py-cryptography
2022-10-19fighting a losing battle against the py-cryptography rustification, part 3nia1-1/+2
Re-import the last version of py-OpenSSL without a hard unnecessary dependency on rustified py-cryptography
2022-10-19fighting a losing battle against py-cryptography rustification, part 2nia13-29/+40
Switch users to versioned_dependencies.mk.
2022-10-19python: Special handling of py-cryptography for versioned_dependencies.mknia1-0/+40
2022-10-19py27-cryptography: Restore support for Python 3, we want this becausenia1-4/+6
it doesn't require rust
2022-10-19Remove "norust" version of py-cryptograpy, it's the same as the "py27" versionnia5-312/+1
2022-10-19Re-import the last Rust-free version of py-cryptography for ARMv6nia5-1/+312
2022-10-17gnupg2: add new patchadam1-0/+16
2022-10-17gnupg2: updated to 2.2.40adam2-6/+7
Noteworthy changes in version 2.2.40 (2022-10-10) ------------------------------------------------- * gpg: Do not consider unknown public keys as non-compliant while decrypting. * gpg: Avoid to emit a compliance mode line if Libgcrypt is non-compliant. * gpg: In de-vs mode use AES-128 instead of 3-DES as implicit preference. * gpgsm: Fix reporting of bad passphrase error during PKCS-11 import. * dirmngr: Fix CRL Distribution Point fallback to other schemes. * dirmngr: New LDAP server flag "areconly" (A-record-only). * dirmngr: Fix upload of multiple keys for an LDAP server specified using the colon format. * dirmngr: Use LDAP schema v2 when a Base DN is specified. * wkd: New command --mirror for gpg-wks-client.
2022-10-15security/py-denyhosts: port to work with python 3.x.he3-3/+28
ListType and TupleType is just "list" and "tuple" in python 3, google reveals... Bump PKGREVISION.
2022-10-15erlang-jose: Update to 1.11.2triaxx2-6/+6
upstream changes: ----------------- 1.11.2 (2021-08-06) o Add compatability with OTP 24
2022-10-15erlang-epam: Update to 1.0.12triaxx2-7/+7
upstream changes: ----------------- Version 1.0.12 o Fix building without calling configure first Version 1.0.11 o Switch from using Travis to Github Actions as CI o Fix compatibility with OTP24
2022-10-15erlang-fast_tls: Update to 1.1.16triaxx3-33/+7
upstream changes: ----------------- Version 1.1.16 o Fix compilations on windows o Reintroduce blocking of renegotions for Openssl < 1.1.0h Version 1.1.15 o Fix compilation on pre c99 systems Version 1.1.14 o Updating p1_utils to version 1.0.25. o Improve compatibility with OpenSSL 3.0 o Improve compatiblity with LibreSSL >= 3.5 o Add 'keyfile', 'dh' and 'fips_mode' options Version 1.1.13 o Updating p1_utils to version 1.0.23. o Switch from using Travis to Github Actions as CI
2022-10-15erlang-pkix: Update to 1.0.9triaxx2-8/+6
upstream changes: ----------------- Version 1.0.9 o Generate documentaion for hex.pm packages o Update CA bundle Version 1.0.8 o Switch from using Travis to Github Actions as CI
2022-10-14erlang-p1_acme: Update to 1.0.20triaxx4-45/+10
upstream changes: ----------------- Version 1.0.20 o Updating yconf to version 1.0.14. Version 1.0.19 o Updating yconf to version 1.0.13. o Fix order in which dependencies are started Version 1.0.18 o Updating jiffy to version 1.1.1 to support Mix compilation again Version 1.0.17 o Updating jiffy to version 1.1.0 to support Erlang/OTP 25.0-rc1 o Copy code from eimp to use override_deps_versions only when not rebar3 Version 1.0.14 o Generate documentation when publishing to hex o Updating jose to version 1.11.1. Version 1.0.13 o Updating yconf to version 1.0.12. o Switch from using Travis to Github Actions as CI
2022-10-14erlang-p1_oauth2: Update to 0.6.11triaxx2-7/+6
upstream changes: ----------------- Version 0.6.11 o Generate documentation when generating hex.pm package o Remove usage of deprecated crypto functions o Improve errors reporting Version 0.6.10 o Switch from using Travis to Github Actions as CI Version 0.6.9 o Dialyzer: Update Response record definition: fields may be undefined
2022-10-14py-authlib: updated to 1.1.0adam3-66/+82
Version 1.1.0 This release contains breaking changes and security fixes. Allow to pass claims_options to Framework OpenID Connect clients. Fix .stream with context for HTTPX OAuth clients. Fix Starlette OAuth client for cache store. Breaking changes: Raise InvalidGrantError for invalid code, redirect_uri and no user errors in OAuth 2.0 server. The default authlib.jose.jwt would only work with JSON Web Signature algorithms, if you would like to use JWT with JWE algorithms, please pass the algorithms parameter: jwt = JsonWebToken(['A128KW', 'A128GCM', 'DEF']) Security fixes: CVE-2022-39175 and CVE-2022-39174, both related to JOSE. Version 1.0.1 Fix authenticate_none method. Allow to pass in alternative signing algorithm to RFC7523 authentication methods. Fix missing_token for Flask OAuth client. Allow openid in any place of the scope. Security fix for validating essential value on blank value in JWT. Version 1.0.0 We have dropped support for Python 2 in this release. We have removed built-in SQLAlchemy integration. OAuth Client Changes: The whole framework client integrations have been restructured, if you are using the client properly, e.g. oauth.register(...), it would work as before. OAuth Provider Changes: In Flask OAuth 2.0 provider, we have removed the deprecated OAUTH2_JWT_XXX configuration, instead, developers should define .get_jwt_config on OpenID extensions and grant types. SQLAlchemy integrations has been removed from Authlib. Developers should define the database by themselves. JOSE Changes JWS has been renamed to JsonWebSignature JWE has been renamed to JsonWebEncryption JWK has been renamed to JsonWebKey JWT has been renamed to JsonWebToken The "Key" model has been re-designed, checkout the :ref:`jwk_guide` for updates. Added ES256K algorithm for JWS and JWT.
2022-10-12openssl: downgrade to 1.1.1qwiz2-6/+6
The tarball was retracted due to a regression, to quote: We have received a report of a significant regression in the latest 3.0.6 and 1.1.1r versions. The regression is not thought to have security consequences. While the regression is further investigated we have taken the decision to withdraw the 3.0.6 and 1.1.1r versions and instead recommend that users remain on the previous 3.0.5 and 1.1.1q versions for now. We will issue a new plan for the release of 3.0.7 and 1.1.1s soon. From https://mta.openssl.org/pipermail/openssl-announce/2022-October/000237.html
2022-10-12openssl: update to 1.1.1r.wiz2-6/+6
Major changes between OpenSSL 1.1.1q and OpenSSL 1.1.1r [11 Oct 2022] o Added a missing header for memcmp that caused compilation failure on some platforms
2022-10-12Changes since OpenSSH 9.0wiz2-7/+6
========================= This release is focused on bug fixing. Security ======== This release contains fixes for three minor memory safety problems. None are believed to be exploitable, but we report most memory safety problems as potential security vulnerabilities out of caution. * ssh-keyscan(1): fix a one-byte overflow in SSH- banner processing. Reported by Qualys * ssh-keygen(1): double free() in error path of file hashing step in signing/verify code; GHPR333 * ssh-keysign(8): double-free in error path introduced in openssh-8.9 Potentially-incompatible changes -------------------------------- * The portable OpenSSH project now signs commits and release tags using git's recent SSH signature support. The list of developer signing keys is included in the repository as .git_allowed_signers and is cross-signed using the PGP key that is still used to sign release artifacts: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc * ssh(1), sshd(8): SetEnv directives in ssh_config and sshd_config are now first-match-wins to match other directives. Previously if an environment variable was multiply specified the last set value would have been used. bz3438 * ssh-keygen(8): ssh-keygen -A (generate all default host key types) will no longer generate DSA keys, as these are insecure and have not been used by default for some years. New features ------------ * ssh(1), sshd(8): add a RequiredRSASize directive to set a minimum RSA key length. Keys below this length will be ignored for user authentication and for host authentication in sshd(8). ssh(1) will terminate a connection if the server offers an RSA key that falls below this limit, as the SSH protocol does not include the ability to retry a failed key exchange. * sftp-server(8): add a "users-groups-by-id@openssh.com" extension request that allows the client to obtain user/group names that correspond to a set of uids/gids. * sftp(1): use "users-groups-by-id@openssh.com" sftp-server extension (when available) to fill in user/group names for directory listings. * sftp-server(8): support the "home-directory" extension request defined in draft-ietf-secsh-filexfer-extensions-00. This overlaps a bit with the existing "expand-path@openssh.com", but some other clients support it. * ssh-keygen(1), sshd(8): allow certificate validity intervals, sshsig verification times and authorized_keys expiry-time options to accept dates in the UTC time zone in addition to the default of interpreting them in the system time zone. YYYYMMDD and YYMMDDHHMM[SS] dates/times will be interpreted as UTC if suffixed with a 'Z' character. Also allow certificate validity intervals to be specified in raw seconds-since-epoch as hex value, e.g. -V 0x1234:0x4567890. This is intended for use by regress tests and other tools that call ssh-keygen as part of a CA workflow. bz3468 * sftp(1): allow arguments to the sftp -D option, e.g. sftp -D "/usr/libexec/sftp-server -el debug3" * ssh-keygen(1): allow the existing -U (use agent) flag to work with "-Y sign" operations, where it will be interpreted to require that the private keys is hosted in an agent; bz3429 Bugfixes -------- * ssh-keygen(1): implement the "verify-required" certificate option. This was already documented when support for user-verified FIDO keys was added, but the ssh-keygen(1) code was missing. * ssh-agent(1): hook up the restrict_websafe command-line flag; previously the flag was accepted but never actually used. * sftp(1): improve filename tab completions: never try to complete names to non-existent commands, and better match the completion type (local or remote filename) against the argument position being completed. * ssh-keygen(1), ssh(1), ssh-agent(1): several fixes to FIDO key handling, especially relating to keys that request user-verification. These should reduce the number of unnecessary PIN prompts for keys that support intrinsic user verification. GHPR302, GHPR329 * ssh-keygen(1): when enrolling a FIDO resident key, check if a credential with matching application and user ID strings already exists and, if so, prompt the user for confirmation before overwriting the credential. GHPR329 * sshd(8): improve logging of errors when opening authorized_keys files. bz2042 * ssh(1): avoid multiplexing operations that could cause SIGPIPE from causing the client to exit early. bz3454 * ssh_config(5), sshd_config(5): clarify that the RekeyLimit directive applies to both transmitted and received data. GHPR328 * ssh-keygen(1): avoid double fclose() in error path. * sshd(8): log an error if pipe() fails while accepting a connection. bz3447 * ssh(1), ssh-keygen(1): fix possible NULL deref when built without FIDO support. bz3443 * ssh-keyscan(1): add missing *-sk types to ssh-keyscan manpage. GHPR294. * sshd(8): ensure that authentication passwords are cleared from memory in error paths. GHPR286 * ssh(1), ssh-agent(1): avoid possibility of notifier code executing kill(-1). GHPR286 * ssh_config(5): note that the ProxyJump directive also accepts the same tokens as ProxyCommand. GHPR305. * scp(1): do not not ftruncate(3) files early when in sftp mode. The previous behaviour of unconditionally truncating the destination file would cause "scp ~/foo localhost:foo" and the reverse "scp localhost:foo ~/foo" to delete all the contents of their destination. bz3431 * ssh-keygen(1): improve error message when 'ssh-keygen -Y sign' is unable to load a private key; bz3429 * sftp(1), scp(1): when performing operations that glob(3) a remote path, ensure that the implicit working directory used to construct that path escapes glob(3) characters. This prevents glob characters from being processed in places they shouldn't, e.g. "cd /tmp/a*/", "get *.txt" should have the get operation treat the path "/tmp/a*" literally and not attempt to expand it. * ssh(1), sshd(8): be stricter in which characters will be accepted in specifying a mask length; allow only 0-9. GHPR278 * ssh-keygen(1): avoid printing hash algorithm twice when dumping a KRL * ssh(1), sshd(8): continue running local I/O for open channels during SSH transport rekeying. This should make ~-escapes work in the client (e.g. to exit) if the connection happened to have stalled during a rekey event. * ssh(1), sshd(8): avoid potential poll() spin during rekeying * Further hardening for sshbuf internals: disallow "reparenting" a hierarchical sshbuf and zero the entire buffer if reallocation fails. GHPR287 Portability ----------- * ssh(1), ssh-keygen(1), sshd(8): automatically enable the built-in FIDO security key support if libfido2 is found and usable, unless --without-security-key-builtin was requested. * ssh(1), ssh-keygen(1), sshd(8): many fixes to make the WinHello FIDO device usable on Cygwin. The windows://hello FIDO device will be automatically used by default on this platform unless requested otherwise, or when probing resident FIDO credentials (an operation not currently supported by WinHello). * Portable OpenSSH: remove workarounds for obsolete and unsupported versions of OpenSSL libcrypto. In particular, this release removes fallback support for OpenSSL that lacks AES-CTR or AES-GCM. Those AES cipher modes were added to OpenSSL prior to the minimum version currently supported by OpenSSH, so this is not expected to impact any currently supported configurations. * sshd(8): fix SANDBOX_SECCOMP_FILTER_DEBUG on current Linux/glibc * All: resync and clean up internal CSPRNG code. * scp(1), sftp(1), sftp-server(8): avoid linking these programs with unnecessary libraries. They are no longer linked against libz and libcrypto. This may be of benefit to space constrained systems using any of those components in isolation. * sshd(8): add AUDIT_ARCH_PPC to supported seccomp sandbox architectures. * configure: remove special casing of crypt(). configure will no longer search for crypt() in libcrypto, as it was removed from there years ago. configure will now only search libc and libcrypt. * configure: refuse to use OpenSSL 3.0.4 due to potential RCE in its RSA implementation (CVE-2022-2274) on x86_64. * All: request 1.1x API compatibility for OpenSSL >=3.x; GHPR#322 * ssh(1), ssh-keygen(1), sshd(8): fix a number of missing includes required by the XMSS code on some platforms. * sshd(8): cache timezone data in capsicum sandbox.
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-09 08:46:00 +0000