Version 1.2.0.10
- Check add_reference methods to prevent NoneType has no attribute 'append'
- Changes to STIXPackage to prevent the empty <stix:TTPs/> tag from appearing in serialization
Version 1.2.0.9
- TTPs would fail to serialize XML Kill_Chains if no TTP was set
- Added Python 3.8 to test harness
Version 1.2.0.8
- Add xnl:Type to the PersonName element (CIQ)
- Update the allowable values for PersonName and OrganisationName
- Update tests per recent CybOX release
Version 1.2.0.7
- Update package requirements
Version 2.1.0.21
- New API Objects Support
- 8 New Objects API Classes
- 12 New Common API Classes
- Observable DefinedEffects
- More tests to cover new or existent objects
- Update documentation and coverage
- Rename module cybox/objects/{win_user_object.py → win_user_account_object.py} for consistency
- Some objects have been revised for TypedFields and/or new properties are now available
Version 2.1.0.20
- Fix parsing if algorithm, compression_mechanism, or encryption_mechanism are not present in Factories
- Factory classes now have a register_extension method decorator to extend API classes for the pack/unpack functionality
- The factory will fallback to the Base class when no mapping is found
Version 2.1.0.19
- Implement the Packaging attribute from Artifacts as a TypedField
- Fix a wrapping problem with one of the helper methods for ipv4 observables
Version 2.1.0.18
- Add missing methods to ListFieldMixin.
- Fix handling of empty Hash values.
Update clamav to 0.102.3.
## 0.102.3
ClamAV 0.102.3 is a bug patch release to address the following issues.
- [CVE-2020-3327](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3327):
Fix a vulnerability in the ARJ archive parsing module in ClamAV 0.102.2 that
could cause a Denial-of-Service (DoS) condition. Improper bounds checking of
an unsigned variable results in an out-of-bounds read which causes a crash.
Special thanks to Daehui Chang and Fady Othman for helping identify the ARJ
parsing vulnerability.
- [CVE-2020-3341](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3341):
Fix a vulnerability in the PDF parsing module in ClamAV 0.101 - 0.102.2 that
could cause a Denial-of-Service (DoS) condition. Improper size checking of
a buffer used to initialize AES decryption routines results in an out-of-
bounds read which may cause a crash. Bug found by OSS-Fuzz.
- Fix "Attempt to allocate 0 bytes" error when parsing some PDF documents.
- Fix a couple of minor memory leaks.
- Updated libclamunrar to UnRAR 5.9.2.
These PLIST files have been autogenerated by mk/haskell.mk using
HS_UPDATE_PLIST=yes during a bulk build. They will help to track changes
to the packages. The Haskell packages didn't have PLIST files because
their paths contained package hashes. These hashes are now determined by
mk/haskell.mk, which makes it easy to generate easy to read PLIST files.
1.4.0:
Added
* Turn off session tickets for apache plugin by default when appropriate.
* Added serial number of certificate to the output of `certbot certificates`
* Expose two new environment variables in the authenticator and cleanup scripts used by
the `manual` plugin: `CERTBOT_REMAINING_CHALLENGES` is equal to the number of challenges
remaining after the current challenge, `CERTBOT_ALL_DOMAINS` is a comma-separated list
of all domains challenged for the current certificate.
* Added TLS-ALPN-01 challenge support in the `acme` library. Support of this
challenge in the Certbot client is planned to be added in a future release.
* Added minimal proxy support for OCSP verification.
* On Windows, hooks are now executed in a Powershell shell instead of a CMD shell,
allowing both `*.ps1` and `*.bat` as valid scripts for Certbot.
Changed
* Reorganized error message when a user entered an invalid email address.
* Stop asking interactively if the user would like to add a redirect.
* `mock` dependency is now conditional on Python 2 in all of our packages.
* Deprecate certbot-auto on Gentoo, macOS, and FreeBSD.
Fixed
* When using an RFC 8555 compliant endpoint, the `acme` library no longer sends the
`resource` field in any requests or the `type` field when responding to challenges.
* Fix nginx plugin crash when non-ASCII configuration file is being read (instead,
the user will be warned that UTF-8 must be used).
* Fix hanging OCSP queries during revocation checking - added a 10 second timeout.
* Standalone servers now have a default socket timeout of 30 seconds, fixing
cases where an idle connection can cause the standalone plugin to hang.
* Parsing of the RFC 8555 application/pem-certificate-chain now tolerates CRLF line
endings. This should fix interoperability with Buypass' services.
More details about these changes can be found on our GitHub repo.
This release updates Firefox to 68.8.0esr, NoScript to 11.0.25, and OpenSSL to 1.1.1g.
Also, this release features important security updates to Firefox.
The full changelog since Tor Browser 9.0.9 is:
All Platforms
Update Firefox to 68.8.0esr
Bump NoScript to 11.0.25
Windows + OS X + Linux
Bug 34017: Bump openssl version to 1.1.1g
Changes:
(No changelog available but main changes inspecting commits):
- Add check for wordpress installer in subdir
- Remove CVS test, produces too false positives and hardly any true positives
- Add installer check for common PHP web applications
- Add info check for composer files
- Add info check for mailman
- Add check for monit default webinterface credentials
- Rework optionsbleed check and avoid ReDoS attack (upstream issue #24)
ensure all exported functions use a unique prfix, so that they don't
conflict with symbols (both data and text) in libcrypto. this works for
statically linked binaries and libraries, rather then the version map which
only works for dynalically-linked.
Add ruby-chef-vault package version 4.0.1.
Chef-Vault
Chef-Vault allows you to encrypt a Chef Data Bag Item using the public keys
of a list of chef nodes. This allows only those chef nodes to decrypt the
encrypted values.
For a more detailed explanation of how chef-vault works, please refer to
this blog post Chef Vault - what is it and what can it do for you? by Nell
Shamrell-Harrington.
Install and use the fonts distributed with the Linux binary of tor-browser.
Reduces fingerprinting possibilities based on installed fonts.
Idea from Caspar Schutijser, the OpenBSD ports maintainer, and
based on his patch for OpenBSD ports.
This is a hack to work around a mistake in the NetBSD openpam build
which leaked into the public header files. We will fix this in the
NetBSD build but it's been in the public header files for nearly a
decade now, with each individual pam module sometimes having this
workaround, so let's apply the workaround uniformly for now.
PR security/39313
PR security/55216
Inspired by a XKCD webcomic and by Steve Gibson's Password Haystacks
page, HSXKPasswd is a Perl module (Crypt::HSXKPasswd) and terminal
command (hsxkpasswd) for generating passwords that are secure,
memorable, and easy to read, type, and share over the phone.
Automatically install the noscript extension.
(https-everywhere package is ready, but doesn't work.)
Change the default path in the home directory to ".tor-browser"
to be more similar to other mozilla products.
By default, use the standard tor port. No separate instance
of tor is started for tor-browser from pkgsrc.
The NoScript Firefox extension provides extra protection for
browsers: this free, open source add-on allows JavaScript, Java,
Flash, and other plugins to be executed only by trusted web sites
of your choice (e.g., your online bank).
