security/tor: Update to 0.3.2.9
This release contains many new features and many bugfixes.
Plesee see the complete list here:
https://blog.torproject.org/tor-0329-released-we-have-new-stable-series
Additionally, this update adds "#include <osreldate.h>" to qualm the
compiler warning that was caused by the previous fix.
Now security/tor and security/tor-devel are identical.
security/tor: Update to 0.3.2.10
Backport of countermeasures to mitigate denial-of-service
attacks against the Tor network.
Changelog is in:
https://gitweb.torproject.org/tor.git/tree/ChangeLog
None of these fixes appear to be essential for clients, but relays
should upgrade.
Port changes:
* Changed the implementation of 'tor_setuid': now it is done through
the command line argument, instead of the torrc file.
BUILD_DEPENDS against `devel/llvm' was not sufficient, since ISPC binary is
actually linked to libLLVM.so. Make it LIB_DEPENDS and thus try to unbreak
`graphics/embree'.
Reported by: pkg-fallout
sysutils/froxlor: Fix packaging when APACHE option is unset
The pkg-plist for some entries relied on the AP_NAME variable, which is
only defined when the APACHE option is set (the default), via
bsd.apache.mk. The variables value is the ports name, so replace it with
PORTNAME accordingly.
While I'm here, fix misspelled PORTREVIION.
Reported by: z3dm4n (via IRC)
Approved by: portmgr (blanket)
sysutils/py-salt: Update to 2017.7.4
This is a bugfix release for the 2017.7.x branch.
Changes this release:
https://docs.saltstack.com/en/latest/topics/releases/2017.7.4.html
PR: 226319
Approved by: Christer Edwards (maintainer)
Approved by: ports-secteam (riggs)
- Fix build with aarch64, armv6, armv7
- Fix QT4 option on all platforms (needs USES=gmake, and fix for moc location)
- Remove some substitutions that didn't do anything
- Don't try to create directories already in mtree
Approved by: ports-secteam (blanket)
It appears as if the development branch of ntp is dead as no new
development tarballs have been relesed for ~ 17 months now. This is a
security concern.
Approved by: portmgr (riggs)
gecko: convert to CONFIGURE_OUTSOURCE
client.mk is on its way out upstream, switching to it was a mistake.
$ MACH=1 gmake -f client.mk build
client.mk:40: /.mozconfig-client-mk: No such file or directory
gmake: *** No rule to make target '/.mozconfig-client-mk'. Stop.
Approved by: ports-secteam (riggs)
Fix build on 11 and later with c++ compilers by default in c++11 mode
PR: 226213
Submitted by: portmaster@bsdforge.com (maintainer)
Approved by: ports-secteam (build fix blanket)
Update to 1.28 which fixes a buffer overflow (that will be)
documented in CVE-2017-17663.
Reviewed by: matthew (mentor)
Approved by: matthew (mentor)
Security: f5524753-67b1-4c88-8114-29c2d258b383
Differential Revision: https://reviews.freebsd.org/D14218
Approved by: ports-secteam (feld)
Update to version 1.6.3
Shibboleth SP software vulnerable to forged user attribute data
====================================================================
The Service Provider software relies on a generic XML parser to process
SAML responses and there are limitations in older versions of the parser
that make it impossible to fully disable Document Type Definition (DTD)
processing.
Through addition/manipulation of a DTD, it's possible to make changes
to an XML document that do not break a digital signature but are
mishandled by the SP and its libraries. These manipulations can alter
the user data passed through to applications behind the SP and result
in impersonation attacks and exposure of protected information.
While the use of XML Encryption can serve as a mitigation for this bug,
it may still be possible to construct attacks in such cases, and the SP
does not provide a means to enforce its use.
An updated version of XMLTooling-C (V1.6.3) is available that works
around this specific bug.
While newer versions of the parser are configured by the SP into
disallowing the use of a DTD via an environment variable, this feature
is not present in the parser used on some supported platforms (notably
Red Hat and CentOS 7), so an additional fix is being provided now that
an actual DTD exploit has been identified.
Security: CVE-2018-0486
Shibboleth SP software vulnerable to additional data forgery flaws
The XML processing performed by the Service Provider software has been
found to be vulnerable to new flaws similar in nature to the one
addressed in an advisory last month.
Security: 22438240-1bd0-11e8-a2ec-6cc21735f730
URL: https://shibboleth.net/community/advisories/secadv_20180227.txt
Approved by: ports-secteam
Use USE_GITHUB instead of hand crafting urls.
Sponsored by: Absolight
Add a NETMAP option to build and install the bro netmap plugin.
PR: 224918
Reported by: Shane Peters
Reviewed by: matthew (mentor)
Approved by: matthew (mentor)
Differential Revision: https://reviews.freebsd.org/D14378
Update to 2.5.3 which fixes an integer overflow:
http://blog.bro.org/2018/02/bro-253-released-security-update.html
Note that a CVE has not been assigned yet.
Reviewed by: matthew (mentor)
Approved by: matthew (mentor)
Differential Revision: https://reviews.freebsd.org/D14444
Approved by: ports-secteam (swills)
2018-03-01 Security Update Release
The PostgreSQL Global Development Group has released an update to all supported
versions of the PostgreSQL database system, including 10.3, 9.6.8, 9.5.12,
9.4.17, and 9.3.22.
The purpose of this release is to address CVE-2018-1058, which describes how a
user can create like-named objects in different schemas that can change the
behavior of other users' queries and cause unexpected or malicious behavior,
also known as a "trojan-horse" attack. Most of this release centers around added
documentation that describes the issue and how to take steps to mitigate the
impact on PostgreSQL databases.
We strongly encourage all of our users to please visit
https://wiki.postgresql.org/wiki/A_Guide_to_CVE-2018-1058:_Protect_Your_Search_Path
for a detailed explanation of CVE-2018-1058 and how to protect your PostgreSQL
installations.
After evaluating the documentation for CVE-2018-1058, a database administrator
may need to take follow up steps on their PostgreSQL installations to ensure
they are protected from exploitation.
Security: CVE-2018-1058
Approved by: portmgr
Update dovecot to 2.2.34, and bump pigeonhole.
* CVE-2017-15130: TLS SNI config lookups may lead to excessive
memory usage, causing imap-login/pop3-login VSZ limit to be reached
and the process restarted. This happens only if Dovecot config has
local_name { } or local { } configuration blocks and attacker uses
randomly generated SNI servernames.
* CVE-2017-14461: Parsing invalid email addresses may cause a crash or
leak memory contents to attacker. For example, these memory contents
might contain parts of an email from another user if the same imap
process is reused for multiple users. First discovered by Aleksandar
Nikolic of Cisco Talos. Independently also discovered by "flxflndy"
via HackerOne.
* CVE-2017-15132: Aborted SASL authentication leaks memory in login
process.
* Linux: Core dumping is no longer enabled by default via
PR_SET_DUMPABLE, because this may allow attackers to bypass
chroot/group restrictions. Found by cPanel Security Team. Nowadays
core dumps can be safely enabled by using "sysctl -w
fs.suid_dumpable=2". If the old behaviour is wanted, it can still be
enabled by setting:
import_environment=$import_environment PR_SET_DUMPABLE=1
* doveconf output now includes the hostname.
+ mail_attachment_detection_options setting controls when
$HasAttachment and $HasNoAttachment keywords are set for mails.
+ imap: Support fetching body snippets using FETCH (SNIPPET) or
(SNIPPET (LAZY=FUZZY))
+ fs-compress: Automatically detect whether input is compressed or not.
Prefix the compression algorithm with "maybe-" to enable the
detection, for example: "compress:maybe-gz:6:..."
+ Added settings to change dovecot.index* files' optimization behavior.
See https://wiki2.dovecot.org/IndexFiles#Settings
+ Auth cache can now utilize auth workers to do password hash
verification by setting auth_cache_verify_password_with_worker=yes.
+ Added charset_alias plugin. See
https://wiki2.dovecot.org/Plugins/CharsetAlias
+ imap_logout_format and pop3_logout_format settings now support all of
the generic variables (e.g. %{rip}, %{session}, etc.)
+ Added auth_policy_check_before_auth, auth_policy_check_after_auth
and auth_policy_report_after_auth settings.
- v2.2.33: doveadm-server: Various fixes related to log handling.
- v2.2.33: doveadm failed when trying to access UNIX socket that didn't
require authentication.
- v2.2.33: doveadm log reopen stopped working
- v2.2.30+: IMAP stopped advertising SPECIAL-USE capability
- v2.2.30+: IMAP stopped sending untagged OK/NO storage notifications
- replication: dsync sends unnecessary replication notification for
changes it does internally. NOTE: Folder creates, renames, deletes
and subscribes still trigger unnecessary replication notifications,
but these should be rather rare.
- mail_always/never_cache_fields setting changes weren't applied for
existing dovecot.index.cache files.
- Fix compiling and other problems with OpenSSL v1.1
- auth policy: With master user logins, lookup using login username.
- FTS reindexed all mails unnecessarily after loss of
dovecot.index.cache file
- mdbox rebuild repeatedly fails with "missing map extension"
- SSL connections may have been hanging with imapc or doveadm client.
- cassandra: Using protocol v3 (Cassandra v2.1) caused memory leaks and
also timestamps weren't set to queries.
- fs-crypt silently ignored public/private keys specified in
configuration (mail_crypt_global_public/private_key) and just
emitted plaintext output.
- lock_method=dotlock caused crashes
- imapc: Reconnection may cause crashes and other errors
Security: CVE-2017-14461
Security: CVE-2017-15130
Security: CVE-2017-15132
Approved by: ports-secteam (delphij), adamw
