* Major changes in 0.0.8
** epa-file.el can now specify recipient keys from the file local
variable `epa-file-encrypt-to'.
** Always encode passphrase with eol-type LF.
** Allow empty user IDs.
** Support handling notations on the signature.
* Major changes in 0.0.7
** Fixed a clearsign verification bug.
While fixing a bug reported by Hugh Warrington, a buffer overflow has
been identified in all released GnuPG versions. The current versions
1.4.5 and 2.0.0 are affected. A small patch is provided.
...
2006-11-27 Werner Koch <wk@g10code.com>
* openfile.c (ask_outfile_name): Fixed buffer overflow occurring
if make_printable_string returns a longer string. Fixes bug 728.
Bump PKGREVISION.
been identified in all released GnuPG versions. Exploiting this
overflow seems to be possible. Apply the following patch to GnuPG."
2006-11-27 Werner Koch <wk@g10code.com>
gnupg2 has been patched accordingly.
Based on PR 33317 by Yoshito Komatsu.
SASL is a method for adding authentication support to connection-based
protocols. To use SASL, a protocol includes a command for identifying and
authenticating a user to a server and for optionally negotiating protection
of subsequent protocol interactions. If its use is negotiated, a security
layer is inserted between the protocol and the connection.
This is the Cyrus SASL plugin that implements the LDAPDB authentication
- Save/load user configuration when using CGI authentication mode (#181).
- Show Prewikka version in the About page (#177).
- Use Python logging facility (available backend: stderr, file, smtp, syslog),
multiple simultaneous handler supported (#113).
- Fix anonymous authentication.
- Fix external process going into zombie state (#178).
- Display correct alertident for invalid CorrelationAlert analyzerid/messageid pair.
- prewikka-httpd should now log the source address.
- Thread safety fixes.
GnuPG-2 provides several utilities that are used by mail clients,
such as Kmail and Balsa, including OpenPGP and S/MIME support.
GnuPG-2 has a different architecture than GnuPG-1 (e.g. 1.4.5) in that
it splits up functionality into several modules. However, both
versions may be installed alongside without any conflict. In fact,
the gpg version from GnuPG-1 is able to make use of the gpg-agent as
included in GnuPG-2 and allows for seamless passphrase caching. The
advantage of GnuPG-1 is its smaller size and the lack of dependency on
other modules at run and build time.
Changes since the 2.0.12 release:
Improvements and changes in the GUI
* The GUI works much faster with very large object trees.
* "Where used" menu item to quickly find and show all groups and
firewall rules that reference given object. Confirmation dialog
shown when an object is deleted also shows all groups and rules
that use it.
* Built-in installer can now save a copy of .fwb file to the firewall.
* Compile/install dialog is now an independent window instead of a modal
dialog, this means the user can look at the policy and objects while
compilation and/or installation is going on.
* Network discovery driud is back, ported from fwbuilder 1.0. As before,
it supports reading object definitions from a file in /etc/hosts
format, can read DNS zone and also can crawl the network using SNMP
queries.
* Startup splash window has been removed.
* Keeping track of dependencies between objects. Firewalls that refer
to an object that is modified are marked with bold font.
* Added bulk compile and install operations.
* All object dialogs have been converted into built-in panels that
appear in the right hand part of the main window.
* Improvements in "Find" function: administrator can now drag an object
into a well in the find dialog panel to make it search for this
particular object.
* The "Find and replace" operation has been implemented.
New object types, new rule types and rule elements, new actions and other new
features
* AddressTable This object resolves to a set of IP addresses defined in
an external file.
* DNSName: This object resolves a host name to the IP address using
DNS. Object can be confgiured to do so at compile time or run time.
* TagService: This object matches tags set by action Tag.
* Interface objects can now be marked as bridge ports.
* Support for routing rules has been implemented.
* Global policy and interface policies have been merged. Each policy
rule now has rule element "Interface".
* Policy rules can have the following new actions:
* Queue: This action passes the packet to user space process for
inspection.
* Custom: This action allows administrator to define arbitrary
piece of code to be used in place of an action.
* Branch: This action is used to create a branch in the rule set.
* Tag: This action associates internal tag with the packet.
* Classify: This action allows the firewall to define QoS class
for the packet that matches the rule.
* Route: This action makes the firewall to route the packet that
matches the rule through an interface or a gateway specified in
the parameters of the action.
* Firewall object now has an attribute "inactive" excluding it from
bulk compiles and installs.
Compiler for iptables
* Support for address tables loaded from external files at compile or
run time.
* Support user defined chains with predefined names (using special
action )
* Support for CLASSIFY, MARK, CONNMARK, QUEUE, ROUTE targets
* Support for physdev module for bridging firewalls
* additional optimization of rules in INPUT and OUTPUT chain: now
removing firewall object from src or dst to simplify rule if it uses
OUTPUT or INPUT chain.
* support for modules connlimit and hashlimit.
Compiler for PF
* Support for load balancing rules
* Support for tag and route options
* Support for address ranges and network objects in TSrc in NAT rules
* Support for pool types in NAT rules ('bitmask', 'random',
'source-hash', 'round-robin'), as well as 'static-port' option.
* Supprot for anchors (by way of a special action)
* Support for tables with predefined names (using AddressTable object)
* Support for packet 'tagging' (by way of a special action and service
object TagService)
Compiler for ipfilter
* Support for PPTP and IRC proxies
* Support for route option
API
* internal object ID is augumented with process ID of the program that
creates an object.
* fwbedit
Fwbedit can now create objects and repair broken object database.
Changes since the the 2.0.12 release:
Improvements and changes in the GUI
* The GUI works much faster with very large object trees.
* "Where used" menu item to quickly find and show all groups and
firewall rules that reference given object. Confirmation dialog
shown when an object is deleted also shows all groups and rules
that use it.
* Built-in installer can now save a copy of .fwb file to the firewall.
* Compile/install dialog is now an independent window instead of a modal
dialog, this means the user can look at the policy and objects while
compilation and/or installation is going on.
* Network discovery driud is back, ported from fwbuilder 1.0. As before,
it supports reading object definitions from a file in /etc/hosts
format, can read DNS zone and also can crawl the network using SNMP
queries.
* Startup splash window has been removed.
* Keeping track of dependencies between objects. Firewalls that refer
to an object that is modified are marked with bold font.
* Added bulk compile and install operations.
* All object dialogs have been converted into built-in panels that
appear in the right hand part of the main window.
* Improvements in "Find" function: administrator can now drag an object
into a well in the find dialog panel to make it search for this
particular object.
* The "Find and replace" operation has been implemented.
New object types, new rule types and rule elements, new actions and other new
features
* AddressTable This object resolves to a set of IP addresses defined in
an external file.
* DNSName: This object resolves a host name to the IP address using
DNS. Object can be confgiured to do so at compile time or run time.
* TagService: This object matches tags set by action Tag.
* Interface objects can now be marked as bridge ports.
* Support for routing rules has been implemented.
* Global policy and interface policies have been merged. Each policy
rule now has rule element "Interface".
* Policy rules can have the following new actions:
* Queue: This action passes the packet to user space process for
inspection.
* Custom: This action allows administrator to define arbitrary
piece of code to be used in place of an action.
* Branch: This action is used to create a branch in the rule set.
* Tag: This action associates internal tag with the packet.
* Classify: This action allows the firewall to define QoS class
for the packet that matches the rule.
* Route: This action makes the firewall to route the packet that
matches the rule through an interface or a gateway specified in
the parameters of the action.
* Firewall object now has an attribute "inactive" excluding it from
bulk compiles and installs.
Compiler for iptables
* Support for address tables loaded from external files at compile or
run time.
* Support user defined chains with predefined names (using special
action )
* Support for CLASSIFY, MARK, CONNMARK, QUEUE, ROUTE targets
* Support for physdev module for bridging firewalls
* additional optimization of rules in INPUT and OUTPUT chain: now
removing firewall object from src or dst to simplify rule if it uses
OUTPUT or INPUT chain.
* support for modules connlimit and hashlimit.
Compiler for PF
* Support for load balancing rules
* Support for tag and route options
* Support for address ranges and network objects in TSrc in NAT rules
* Support for pool types in NAT rules ('bitmask', 'random',
'source-hash', 'round-robin'), as well as 'static-port' option.
* Supprot for anchors (by way of a special action)
* Support for tables with predefined names (using AddressTable object)
* Support for packet 'tagging' (by way of a special action and service
object TagService)
Compiler for ipfilter
* Support for PPTP and IRC proxies
* Support for route option
API
* internal object ID is augumented with process ID of the program that
creates an object.
* fwbedit
Fwbedit can now create objects and repair broken object database.
Changes:
Security bugs resolved in this release:
* Fix a bug in the sshd privilege separation monitor that weakened its
verification of successful authentication. This bug is not known to
be exploitable in the absence of additional vulnerabilities.
This release includes the following non-security fixes:
* Several compilation fixes for portable OpenSSH
* Fixes to Solaris SMF/process contract support (bugzilla #1255)
- Fixed handling of user/domain name splitting in the client library
when the caller doesn't initially provide a domain name.
- cvm_client_setenv now also sets $MAILDIR for use with Courier IMAP.
web applications (or a web application firewall). Operating as an Apache Web
server module or standalone, the purpose of ModSecurity is to increase web
application security, protecting web applications from known and unknown
attacks.
This is the 2.x branch of modsecurity and only supports Apache 2.x
