aboutsummaryrefslogtreecommitdiff
path: root/security
Commit message (Collapse)AuthorAgeFilesLines
* all: R eturn sobomax' ports to the poolMuhammad Moinur Rahman2022-09-051-1/+1
| | | | | | | | Commit bit of sobomax@ was safe-kept on 2018-12-03 by portmgr-secretary@ but somehow the ports were not reset. Reset all the ports except net/ortp which has been exclusively requested by zirias@ Approved by: portmgr (blanket)
* security/ubuntu-keyring: update to 2021.03.26Mia Rain2022-09-052-9/+9
| | | | | | | Reporter becomes maintainer. PR: 266147 Reported by: Mia Rain <mia-rain@tuta.io>
* security/libgsasl: Update to 2.2.0Po-Chuan Hsieh2022-09-043-9/+9
| | | | Changes: https://gitlab.com/gsasl/gsasl/-/blob/master/NEWS
* security/gsasl: Update to 2.2.0Po-Chuan Hsieh2022-09-042-4/+4
| | | | Changes: https://gitlab.com/gsasl/gsasl/-/blob/master/NEWS
* security/py-netmiko: Update to 4.1.2Kai Knoblich2022-09-044-24/+24
| | | | | | | | * Update pkg-descr to match reality. Changelog: https://github.com/ktbyers/netmiko/releases/tag/v4.1.2 MFH: No (py-netmiko 4.x not present in 2022Q3)
* security/wolfssl: Update to v5.5.0Santhosh Raju2022-09-043-6/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes since v5.4.0: wolfSSL Release 5.5.0 (Aug 30, 2022) Note: ** If not free’ing FP_ECC caches per thread by calling wc_ecc_fp_free there is a possible memory leak during TLS 1.3 handshakes which use ECC. Users are urged to confirm they are free’ing FP_ECC caches per thread if enabled to avoid this issue. Release 5.5.0 of wolfSSL embedded TLS has bug fixes and new features including: Vulnerabilities * [Low] Fault injection attack on RAM via Rowhammer leads to ECDSA key disclosure. Users doing operations with private ECC keys such as server side TLS connections and creating ECC signatures, who also have hardware that could be targeted with a sophisticated Rowhammer attack should update the version of wolfSSL and compile using the macro WOLFSSL_CHECK_SIG_FAULTS. Thanks to Yarkin Doroz, Berk Sunar, Koksal Must, Caner Tol, and Kristi Rahman all affiliated with the Vernam Applied Cryptography and Cybersecurity Lab at Worcester Polytechnic Institute for the report. * [Low] In wolfSSL version 5.3.0 if compiled with --enable-session-ticket and the client has non-empty session cache, with TLS 1.2 there is the possibility of a man in the middle passing a large session ticket to the client and causing a crash due to an invalid free. There is also the potential for a malicious TLS 1.3 server to crash a client in a similar manner except in TLS 1.3 it is not susceptible to a man in the middle attack. Users on the client side with –enable-session-ticket compiled in and using wolfSSL version 5.3.0 should update their version of wolfSSL. Thanks to Max at Trail of Bits for the report and "LORIA, INRIA, France" for research on tlspuffin. * [Low] If using wolfSSL_clear to reset a WOLFSSL object (vs the normal wolfSSL_free/wolfSSL_new) it can result in runtime issues. This exists with builds using the wolfSSL compatibility layer (--enable-opnesslextra) and only when the application is making use of wolfSSL_clear instead of SSL_free/SSL_new. In the case of a TLS 1.3 resumption, after continuing to use the WOLFSSH object after having called wolfSSL_clear, an application could crash. It is suggested that users calling wolfSSL_clear update the version of wolfSSL used. Thanks to Max at Trail of Bits for the report and "LORIA, INRIA, France" for research on tlspuffin. * Potential DoS attack on DTLS 1.2. In the case of receiving a malicious plaintext handshake message at epoch 0 the connection will enter an error state reporting a duplicate message. This affects both server and client side. Users that have DTLS enabled and in use should update their version of wolfSSL to mitigate the potential for a DoS attack. New Feature Additions * QUIC support added, for using wolfSSL with QUIC implementations like ngtcp2 * SE050 port additions and fixes * Added support for Dilithium post quantum algorithm use with TLS * Support for RSA-PSS signed certificates * Support for Infineon AURIX IDE * Add Zephyr support for nRF5340 with CryptoCell-312 Enhancements * Expanded ABI support by 50 APIs to include wolfCrypt and Certificates making a total of 113 ABIs controlled and maintained * DTLS 1.3 partial support for ConnectionID as described by RFC9146 and RFC9147 * Added support for X509_CRL_print function * Remove deprecated algorithms in Renesas cs+ project * Support more build options disable/enable with i.MX CAAM build * wolfSSL_CTX_set_options and wolfSSL_CTX_get_options functions added to non compatibility layer builds * TFM: change inline x86 asm code to compile with clang * Improvements to error queue and fix for behavior of wolfSSL_ERR_get_error * scripts/makedistsmall.sh script added for creating a small source/header only package * TLS 1.3: restrict extension validity by message, Extensions ServerName, SupportedGroups and ALPN must not appear in server_hello * Add liboqs integration to CMake build system * Adds wolfSSL_PEM_read_RSAPrivateKey() to the OpenSSL compatible API * Added support for P384 pre-share in bundled example server * Replace clz assembly instruction in ARM 32 builds when not supported * Integrate chacha20-poly1305 into the EVP interface * Additional validation that extensions appear in correct messages * Allow SAN to be critical with ASN template build * Support wolfSSL_CTX_set1_curves_list being available when X25519 and/or X448 only defined * Adds wolfSSL_PEM_read_RSA_PUBKEY() to the OpenSSL compatible API * Match OpenSSL self signed error return with compatibility layer build * Added wolfSSL_dtls_create_peer and wolfSSL_dtls_free_peer to help with Python and Go wrappers for DTLS Fixes * DTLS 1.3 asynchronous use case fixes * Fix handling of counter to support incrementing across all bytes in ARM crypto asm * Fixes for ED25519/ED448 private key with public key export (RFC8410) * Fix for build with NO_TLS macro * Fix for write dup function to copy over TLS version * Fix to handle path lengths of 0 when checking certificate CA path lengths * Fix for CMake not installing sp_int.h for SP math all * When WOLFSSL_VALIDATE_ECC_IMPORT is defined ECC import validates private key value is less than order * PSA crypto fixes * Fix for not having default pkcs7 signed attributes * DTLS socket and timeout fixes * SP int: exptmod ensure base is less than modulus * Fix for AddPacketInfo with WOLFSSL_CALLBACKS to not pass encrypted TLS 1.3 handshake messages to callbacks * Fix for sniffer to ensure the session was polled before trying to reprocess it
* security/libssh: Update to 0.10.2Po-Chuan Hsieh2022-09-043-5/+5
| | | | Changes: https://git.libssh.org/projects/libssh.git/tree/CHANGELOG?h=stable-0.10
* security/boringssl: update to the recent commitSergey A. Osokin2022-09-032-5/+5
|
* security/gopass: Update to 1.14.5Nuno Teixeira2022-09-032-9/+8
| | | | ChangeLog: https://github.com/gopasspw/gopass/blob/master/CHANGELOG.md
* security/p5-IO-Socket-SSL: Update to 2.075Wen Heping2022-09-032-4/+4
| | | | | PR: 266198 Reported by: svysh.fbsd@gmail.com(maintainer)
* security/vuxml: add www/chromium < 105.0.5195.102Rene Ladan2022-09-031-0/+30
| | | | Obtained from: https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html
* security/hockeypuck: Reset MAINTAINERNeel Chauhan2022-09-021-1/+1
|
* security/hockeypuck: Adopt portNeel Chauhan2022-09-021-1/+1
|
* security/hockeypuck: drop maintainershipMichiel van Baak Jansen2022-09-021-1/+1
| | | | | | | | | | | I have not been running hockeypuck for a while now, and I dont see myself having time nor motivation in the near future to test and review patches. I hope someone actually using hockeypuck will do a better job at maintaining this port then me. PR: 266178
* security/hashcat: upgrade to 6.2.6Stefan Eßer2022-09-025-18/+212
| | | | | This release adds new backend support for Metal, the OpenCL replacement API on Apple, many new hash-modes, and some bug fixes.
* security/vuxml: Unbreak vuxml buildAshish SHUKLA2022-09-011-2/+2
| | | | | Fix malformed CVE entry which I added in 46eb6e07f37e2. Thanks to dbaio@ for pointing it out.
* dns/powerdns-recursor: Add VUXML entryRalf van der Enden2022-09-011-0/+28
|
* security/py-ropgadget: Update to 7.0Emanuel Haupt2022-09-012-4/+4
|
* cleanup: remove support for FreeBSD 13.0 which expired today.Rene Ladan2022-09-012-40/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Mk/bsd.port.mk: mark 13.0 as unsupported - Tools/scripts/portsearch: Drop support for FreeBSD <= 4 - archivers/zstd: revert "Fix build on FreeBSD 13.0" - deskutils/xdg-desktop-portal: remove check for 13.0 - devel/libpeas: remove outdated comment - editors/imhex: remove compatibility for 13.0 - editors/libreoffice: remove compatibility for 13.0 - editors/openoffice-4: remove compatibility for 13.0 - editors/openoffice-devel: remove compatibility for 13.0 - emulators/linux_base-c7: remove compatiblity for 13.0 - graphics/drm-kmod: remove detection for 13.0 - graphics/gpu-firmware-amd-kmod: do not check 13.0 anymore - graphics/linux-c7-libdrm: remove support for 13.0 - math/igraph: remove support for 13.0 - net/asterisk16: drop support for ancient FreeBSD versions - net/asterisk18: drop support for ancient FreeBSD versions - security/openssl*: drop now obsolete patches - sysutils/bhyve+: drop support for FreeBSD 13.0 - sysutils/ebsnvme-id: drop support for FreeBSD 13.0 - sysutils/openzfs: remove detection of FreeBSD 13.0 - sysutils/openzfs-kmod: drop detection of FreeBSD 13.0 - www/firefox: generalize pkg-message a bit regarding hgame(4) - x11/xorg-cf-files: remove support for FreeBSD < 6 (yes, pre-2008) While here, regenerate patches for: - x11/xorg-cf-files - net/asterisk16 - net/asterisk18 While here, remove a stale $Id$ from Tools/scripts/portsearch Differential Revision: https://reviews.freebsd.org/D36233 Reviewed by: office (fluffy), x11 (manu), arrowd, brnrd, cperciva, freqlabs, imp, jbeich, madpilot, nobutaka
* security/vuxml: Document Grafana vulnerabilitiesNuno Teixeira2022-09-011-0/+45
| | | | | | - vuxml: CVE-2022-31176 - Unauthorized file disclosure PR: 266128
* security/zaproxy: mark BROKENDmitry Marakasov2022-09-011-0/+2
| | | | | | | | | | | | | * What went wrong: Plugin [id: 'org.gradle.kotlin.kotlin-dsl', version: '2.3.3'] was not found in any of the following sources: - Gradle Core Plugins (plugin is not in 'org.gradle' namespace) - Plugin Repositories (could not resolve plugin artifact 'org.gradle.kotlin.kotlin-dsl:org.gradle.kotlin.kotlin-dsl.gradle.plugin:2.3.3') Searched in the following repositories: Gradle Central Plugin Repository Approved by: portmgr blanket Reported by: pkg-fallout
* security/tailscale: Update to 1.30.0Ashish SHUKLA2022-08-312-7/+6
|
* security/vuxml: Document Matrix clients' vulnerabilitiesAshish SHUKLA2022-08-311-0/+35
|
* security/1password-client2-beta: [NEW PORT]Larry Rosenman2022-08-315-1/+59
| | | | | | | | | Make the beta version of the CLI available in FreeBSD ports. latest changelog: https://app-updates.agilebits.com/product_history/CLI2#v2070101 NOTE: you may need to check the "show betas" checkbox on that link.
* security/py-pysaml2: Update to 7.2.1Po-Chuan Hsieh2022-08-312-4/+4
| | | | Changes: https://github.com/IdentityPython/pysaml2/releases
* security/p5-Net-SAML2: Update to 0.59Po-Chuan Hsieh2022-08-313-4/+9
| | | | Changes: https://metacpan.org/dist/Net-SAML2/changes
* security/libssh: Update to 0.10.1Po-Chuan Hsieh2022-08-314-11/+10
| | | | Changes: https://git.libssh.org/projects/libssh.git/tree/CHANGELOG?h=stable-0.10
* security/py-requests-kerberos: Add missing dependencyDan Langille2022-08-311-1/+3
| | | | security/py-pyspnego is required but was not included
* security/p5-Digest-SHA3: Update to 1.05Po-Chuan Hsieh2022-08-312-4/+4
| | | | Changes: https://metacpan.org/dist/Digest-SHA3/changes
* security/p5-Digest-SHA: Update to 6.03Po-Chuan Hsieh2022-08-312-4/+4
| | | | Changes: https://metacpan.org/dist/Digest-SHA/changes
* security/rubygem-omniauth1: Update to 1.9.2Po-Chuan Hsieh2022-08-312-4/+4
| | | | Changes: https://github.com/omniauth/omniauth/releases
* security/py-pyspnego: Update to 0.6.0Po-Chuan Hsieh2022-08-312-6/+6
| | | | Changes: https://github.com/jborean93/pyspnego/releases
* security/py-pysaml2: Update to 7.2.0Po-Chuan Hsieh2022-08-312-5/+5
| | | | Changes: https://github.com/IdentityPython/pysaml2/releases
* security/py-krb5: Update to 0.4.0Po-Chuan Hsieh2022-08-317-47/+34
| | | | Changes: https://github.com/jborean93/pykrb5/releases
* security/py-google-auth: Update to 2.11.0Po-Chuan Hsieh2022-08-312-4/+4
| | | | Changes: https://github.com/googleapis/google-auth-library-python/releases
* security/py-asyncssh: Update to 2.12.0Po-Chuan Hsieh2022-08-312-4/+4
| | | | Changes: https://github.com/ronf/asyncssh/blob/master/docs/changes.rst
* security/boringssl: update to the recent commitSergey A. Osokin2022-08-312-5/+5
|
* security/vuxml: document www/chromium < 105.0.5195.52Rene Ladan2022-08-311-0/+69
| | | | Obtained from: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
* security/vuxml: add FreeBSD SA-22:13.zlibPhilip Paeps2022-08-311-0/+33
|
* security/fizz: Update 2022.08.22.00 -> 2022.08.29.00Yuri Victorovich2022-08-302-4/+4
|
* security/bruteblock: renovateDmitry Marakasov2022-08-304-23/+29
| | | | | | | | | | | | - Update URLs - Reformat pkg-message and fix service start command [1] - Add LICENSE - Switch to options helpers - Fix manpage location - Silence mkdirs Submitted by: Elvin Aslanov [1] GitHub: fixes #129
* security/vuxml: document gitlab-ce vulnerabilitiesMatthias Fechner2022-08-301-0/+53
|
* security/1password-client2: update to 2.7.0Larry Rosenman2022-08-302-10/+10
| | | | | ChangeLog: https://app-updates.agilebits.com/product_history/CLI2#v2070002
* security/py-xmlsec: Update version 1.3.12=>1.3.13Muhammad Moinur Rahman2022-08-302-11/+6
| | | | Relnotes: https://github.com/xmlsec/python-xmlsec/releases/tag/1.3.13
* security/py-tuf: Update version 1.1.0=>2.0.0Muhammad Moinur Rahman2022-08-302-4/+4
| | | | | Relnotes: https://github.com/theupdateframework/python-tuf/releases/tag/v2.0.0
* security/libomemo: Add new portCy Schubert2022-08-295-0/+44
| | | | | | | | | libomemo implements OMEMO (XEP-0384 v0.3.0) in C. For more information see https://github.com/gkdr/libomemo. PR: 265966 Submitted by: Michael A. Oshin <micadeyeye at gmail.com> Reported by: Michael A. Oshin <micadeyeye at gmail.com>
* security/tinyca: update URL in pkg-descrStefan Eßer2022-08-291-1/+1
|
* security/krb5-devel: update to the latest MIT/KRB5 github commitCy Schubert2022-08-282-5/+5
|
* security/wpa_supplicant-devel: Update to latest GH commitCy Schubert2022-08-282-5/+5
| | | | Update to the latest w1.fi commit, proxied through my GH account.
* security/cfssl: Update 1.6.1 -> 1.6.2Yuri Victorovich2022-08-282-7/+6
| | | | Reported by: portscout
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-16 04:18:30 +0000