Certbot 1.17.0
Added
Add Void Linux overrides for certbot-apache.
Changed
We changed how dependencies are specified between Certbot packages. For this
and future releases, higher level Certbot components will require that lower
level components are the same version or newer. More specifically, version X
of the Certbot package will now always require acme>=X and version Y of a
plugin package will always require acme>=Y and certbot=>Y. Specifying
dependencies in this way simplifies testing and development.
The Apache authenticator now always configures virtual hosts which do not have
an explicit ServerName. This should make it work more reliably with the
default Apache configuration in Debian-based environments.
Fixed
When we increased the logging level on our nginx "Could not parse file" message,
it caused a previously-existing inability to parse empty files to become more
visible. We have now added the ability to correctly parse empty files, so that
message should only show for more significant errors.
It's required to install sub-folders which contains scripts for notify and
dnsapi support. Change default folder for scripts to share folder and symlink
to sbin.
Bump PKGREVISION.
[0.7.2] - 2021-07-20
Added:
-Add the missing views for signature notations
Changed:
-Mark the default signing key with a symbol
Fixed:
-Override the default key for all gpg fallback commands
-Sleep the event handler thread if input is disabled (#29)
With heimdal, you'll get undefined symbol errors like this one:
/usr/pkg/lib/python3.8/site-packages/kerberos.so: Undefined PLT symbol "krb5_free_keytab_entry_contents"
Bump PKGREVISION.
[0.7.1] - 2021-07-17
Added:
-Add an example for selection mode to README.md
Changed:
-Update README.md about libxkbcommon-dev dependency (#26)
Fixed:
-Run the terminal on stderr and use stdout for output (#27)
10.5.2
Windows + OS X + Linux
Update Firefox to 78.12.0esr
Bug 40497: Cannot set multiple pages as home pages in 10.5a17
Bug 40507: Full update is not downloaded after applying partial update fails
Bug 40510: open tabs get redirected to about:torconnect on restart
10.5.1
Android-only
10.5
All Platforms
Update NoScript to 11.2.9
Update Tor Launcher to 0.2.30
Translations update
Bug 25483: Provide Snowflake based on Pion for Windows, macOS, and Linux
Bug 33761: Remove unnecessary snowflake dependencies
Bug 40064: Bump libevent to 2.1.12
Bug 40137: Migrate https-everywhere storage to idb
Bug 40261: Bump versions of snowflake and webrtc
Bug 40263: Update domain front for Snowflake
Bug 40302: Update version of snowflake
Bug 40030: DuckDuckGo redirect to html doesn't work
Windows + OS X + Linux
Bug 27476: Implement about:torconnect captive portal within Tor Browser [tor-browser]
Bug 32228: Bookmark TPO support domains in Tor Browser
Bug 33803: Add a secondary nightly MAR signing key [tor-browser]
Bug 33954: Consider different approach for Bug 2176
Bug 34345: "Don't Bootstrap" Startup Mode
Bug 40011: Rename tor-browser-brand.ftl to brand.ftl
Bug 40012: Fix about:tor not loading some images in 82
Bug 40138: Move our primary nightly MAR signing key to tor-browser
Bug 40209: Implement Basic Crypto Safety
Bug 40428: Correct minor Cryptocurrency warning string typo
Bug 40429: Update Onboarding for 10.5
Bug 40455: Block or recover background requests after bootstrap
Bug 40456: Update the SecureDrop HTTPS-Everywhere update channel
Bug 40475: Include clearing CORS preflight cache
Bug 40478: Onion alias url rewrite is broken
Bug 40484: Bootstrapping page show Quickstart text
Bug 40490: BridgeDB bridge captcha selection is broken in alpha
Bug 40495: Onion pattern is focusable by click on about:torconnect
Bug 40499: Onion Alias doesn't work with TOR_SKIP_LAUNCH
Linux
Bug 40089: Remove CentOS 6 support for Tor Browser 10.5
Build System
All Platforms
Update Go to 1.15.13
Bug 23631: Use rootless containers [tor-browser-build]
Bug 33693: Change snowflake and meek dummy address [tor-browser]
Bug 40016: getfpaths is not setting origin_project
Bug 40169: Update apt package cache after calling pre_pkginst, too
Bug 40194: Remove osname part in cbindgen filename
Windows + OS X + Linux
Bug 40081: Build Mozilla code with --enable-rust-simd
Bug 40104: Use our TMPDIR when creating our .mar files
Bug 40133: Bump Rust version for ESR 78 to 1.43.0
Bug 40166: Update apt cache before calling pre_pkginst in container-image config
Linux
Bug 26238: Move to Debian Jessie for our Linux builds
Bug 31729: Support Wayland
Bug 40041: Remove CentOS 6 support for 10.5 series
Bug 40103: Add i386 pkg-config path for linux-i686
Bug 40112: Strip libstdc++ we ship
Bug 40118: Add missing libdrm dev package to firefox container
Bug 40235: Bump apt for Jessie containers
Changes since v4.7.0:
wolfSSL Release 4.8.0 (July 09, 2021)
Release 4.8.0 of wolfSSL embedded TLS has bug fixes and new features including:
Vulnerabilities
* [Low] OCSP request/response verification issue. In the case that the serial
number in the OCSP request differs from the serial number in the OCSP
response the error from the comparison was not resulting in a failed
verification. We recommend users that have wolfSSL version 4.6.0 and 4.7.0
with OCSP enabled update their version of wolfSSL. Version 4.5.0 and earlier
are not affected by this report. Thanks to Rainer, Roee, Barak, Hila and
Shoshi (from Cymotive and CARIAD) for the report.
* [Low] CVE-2021-24116: Side-Channel cache look up vulnerability in base64 PEM
decoding for versions of wolfSSL 4.5.0 and earlier. Versions 4.6.0 and up
contain a fix and do not need to be updated for this report. If decoding a
PEM format private key using version 4.5.0 and older of wolfSSL then we
recommend updating the version of wolfSSL used. Thanks to Florian Sieck, Jan
Wichelmann, Sebastian Berndt and Thomas Eisenbarth for the report.
New Feature Additions
New Product
* Added wolfSentry build with --enable-wolfsentry and tie-ins to wolfSSL code
for use with wolfSentry
Ports
* QNX CAAM driver added, supporting ECC black keys, CMAC, BLOBs, and TRNG use
* _WIN32_WCE wolfCrypt port added
* INTIME_RTOS directory support added
* Added support for STM32G0
* Renesas RX: Added intrinsics for rot[rl], revl (thanks @rliebscher)
* Added support for running wolfcrypt/test/testwolfcrypt on Dolphin emulator
to test DEVKITPRO port
* Zephyr project port updated to latest version 2.6.X
ASN1 and PKCS
* Storing policy constraint extension from certificate added
* Added support for NID_favouriteDrink pilot
* Added the API function wc_EncryptPKCS8Key to handle encrypting a DER,
PKCS#8-formatted key
Compatibility Layer Additions
* Open Source PORTS Added/Updated
* OpenVPN
* OpenLDAP
* socat-1.7.4.1
* Updated QT port for 5.15.2
* Changes to extend set_cipher_list() compatibility layer API to have
set_ciphersuites compatibility layer API capability
* Added more support for SHA3 in the EVP layer
* API Added
* MD5/MD5_Transform
* SHA/SHA_Transform/SHA1_Transform
* SHA224/SHA256_Transform/SHA512_Transform
* SSL_CTX_get0_param/SSL_CTX_set1_param
* X509_load_crl_file
* SSL_CTX_get_min_proto_version
* EVP_ENCODE_CTX_new
* EVP_ENCODE_CTX_free
* EVP_EncodeInit
* EVP_EncodeUpdate
* EVP_EncodeFinal
* EVP_DecodeInit
* EVP_DecodeUpdate
* EVP_DecodeFinal
* EVP_PKEY_print_public
* BIO_tell
* THREADID_current
* THREADID_hash
* SSL_CTX_set_ecdh_auto
* RAND_set_rand_method()
* X509_LOOKUP_ctrl()
* RSA_bits
* EC_curve_nist2nid
* EC_KEY_set_group
* SSL_SESSION_set_cipher
* SSL_set_psk_use_session_callback
* EVP_PKEY_param_check
* DH_get0_pqg
* CRYPTO_get_ex_new_index
* SSL_SESSION_is_resumable
* SSL_CONF_cmd
* SSL_CONF_CTX_finish
* SSL_CTX_keylog_cb_func
* SSL_CTX_set_keylog_callback
* SSL_CTX_get_keylog_callback
Misc.
* Added wolfSSL_CTX_get_TicketEncCtx getter function to return the ticket
encryption ctx value
* Added wc_AesKeyWrap_ex and wc_AesKeyUnWrap_ex APIs to accept an Aes object
to use for the AES operations
* Added implementation of AES-GCM streaming (--enable-aesgcm-stream)
* Added deterministic generation of k with ECC following RFC6979 when the
macro WOLFSL_ECDSA_DETERMINISTIC_K is defined and wc_ecc_set_deterministic
function is called
* Implemented wc_DsaParamsDecode and wc_DsaKeyToParamsDer
* Asynchronous support for TLS v1.3 TLSX ECC/DH key generation and key
agreement
* Added crypto callback support for Ed/Curve25519 and SHA2-512/384
* TLS 1.3 OPwolfSSL_key_update_response function added to see if a update
response is needed
Fixes
* Fix for detecting extra unused bytes that are in an ASN1 sequence appended
to the end of a valid ECC signature
* Fix for keyid with ktri CMS (breaks compatibility with previous keyid ASN1
syntax)
* Fix for failed handshake if a client offers more than 150 cipher
suites. Thanks to Marcel Maehren, Philipp Nieting, Robert Merget from Ruhr
University Bochum Sven Hebrok, Juraj Somorovsky from Paderborn University
* Fix for default order of deprecated elliptic curves SECP224R1, SECP192R1,
SECP160R1. Thanks to Marcel Maehren, Philipp Nieting, Robert Merget from
Ruhr University Bochum Sven Hebrok, Juraj Somorovsky from Paderborn
University
* Fix for corner TLS downgrade case where a TLS 1.3 setup that allows for
downgrades but has TLS 1.3 set as the minimum version would still downgrade
to TLS 1.2
PKCS7 (Multiple fixes throughout regarding memory leaks with SMIME and heap
buffer overflows due to streaming functionality)
* Fix PKCS7 dynamic content save/restore in PKCS7_VerifySignedData
* Fix for heap buffer overflow on compare with wc_PKCS7_DecryptKtri
* Fix for heap buffer overflow with wc_PKCS7_VerifySignedData
* Fix for heap buffer overflow with wc_PKCS7_DecodeEnvelopedData
* Check size of public key used with certificate passed into
wc_PKCS7_InitWithCert before XMEMCPY to avoid overflow
* Fix for heap buffer overflow fix for wolfSSL_SMIME_read_PKCS7
* Fix to cleanly free memory in error state with wolfSSL_SMIME_read_PKCS7
* SMIME error checking improvements and canonicalize multi-part messages
before hashing
DTLS Fixes
* DTLS fix to correctly move the Tx sequence number forward
* DTLS fix for sequence and epoch number with secure renegotiation cookie
exchange
* Fix for Chacha-Poly AEAD for DTLS 1.2 with secure renegotiation
PORT Fixes
* Fix AES, aligned key for the HW module with DCP port
* Fix ATECC608A TNGTLS certificate size issue (thanks @vppillai)
* Fixes for mingw compile warnings
* Fixes for NXP LTC ECC/RSA
* Fix ESP32 RSA hw accelerator initialization issue
* Fixes for STM32 PKA with ECC
* Fixes for STM32 AES GCM for HAL's that support byte sized headers
* Espressif ESP32 SHA_CTX macro conflict resolved
Math Library Fixes
* For platforms that support limits.h or windows make sure both
SIZEOF_LONG_LONG and SIZEOF_LONG are set to avoid issues with CTC_SETTINGS
* SP C 32/64: fix corner cases around subtraction affecting RSA PSS use
* Fix to return the error code from sp_cond_swap_ct when malloc fails
* Fix potential memory leak with small stack in the function fp_gcd
* Static Analysis Fixes
* Fixes made from Coverity analysis including:
* Cleanups for some return values,
* Fix for leak with wolfSSL_a2i_ASN1_INTEGER
* Sanity check on length in wolfSSL_BN_rand
* Sanity check size in TLSX_Parse catching a possible integer overflow
* Fixes found with -fsanitize=undefined testing
* Fix null dereferences or undefined memcpy calls
* Fix alignment in myCryptoDevCb
* Fix default DTLS context assignment
* Added align configure option to force data alignment
Misc.
* Fix for wolfSSL_ASN1_TIME_adj set length
* Fix for freeing structure on error case in the function AddTrustedPeer
* Return value of SSL_read when called after bidirectional shutdown
* Fix for build options ./configure --enable-dtls --disable-asn
* FIx for detection of a salt length from an RSA PSS signature
* Fix to free up globalRNGMutex mutex when cleaning up global RNG
* Fix leak when multiple hardware names are in SAN
* Fix nonblocking ret value from CRL I/O callbacks
* Fix wolfSSL_BIO_free_all return type to better match for compatibility layer
* Fix for make distcheck, maintainer-clean, to allow distribution builds
* Fix for async with fragmented packets
* Fix for the build or RSA verify or public only
* Fix for return value of wolfSSL_BIO_set_ssl to better match expected
compatibility layer return value
* Fix for sanity checks on size of issuer hash and key along with better
freeing on error cases with DecodeBasicOcspResponse
* Fix for potential memory leak with wolfSSL_OCSP_cert_to_id
Improvements/Optimizations
DTLS/TLS Code Base
* Improved TLS v1.3 time rollover support
* TLS 1.3 PSK: use the hash algorithm to choose cipher suite
* TLS Extended Master Secret ext: TLS13 - send in second Client Hello if in
first
* TLS Encrypt then MAC: check all padding bytes are the same value
* wolfSSL_GetMaxRecordSize updated to now take additional cipher data into
account
* Updated session export/import with DTLS to handle a new internal options
flag
* Refactored dtls_expected_peer_handshake_number handling
* Added wolfSSL_CTX_get_ephemeral_key and wolfSSL_get_ephemeral_key for
loading a constant key in place of an ephemeral one
* Improved checking of XSNPRINTF return value in DecodePolicyOID
Build Options and Warnings
* Added wolfSSL_CTX_set_verify to the ABI list
* Adjusted FP_ECC build to not allow SECP160R1, SECP160R2, SECP160K1 and
SECP224K1. FP_ECC does not work with scalars that are the length of the
order when the order is longer than the prime.
* Added CMake support for CURVE25519, ED25519, CURVE448, and ED448
* cmake addition to test paths when building
* Added support for session tickets in CMake
* Added support for reproducible builds with CMake
* Turn on reproducible-build by default when enable-distro
* Windows Project: Include the X448 and Ed448 files
* GCC-11 compile time warning fixes
* Fix for compiling build of ./configure '--disable-tlsv12'
'-enable-pkcallbacks'
* Added build error for insecure build combination of secure renegotiation
enabled with extended master secret disabled when session resumption is
enabled
* Updated building and running with Apple M1
* Apache httpd build without TLS 1.3 macro guard added
* Enable SHA3 and SHAKE256 requirements automatically when ED448 is enabled
* Added option for AES CBC cipher routines to return BAD_LENGTH_E when called
with an input buffer length not a multiple of AES_BLOCK_SIZE
* Macro WOLFSSL_SP_INT_DIGIT_ALIGN added for alignment on buffers with SP
build. This was needed for compiler building on a Renesas board.
* Build support with no hashes enabled an no RNG compiled in
* Allow use of FREESCALE hardware RNG without a specific port
* Resolved some warnings with Windows builds and PBKDF disabled
* Updated the version of autoconf and automake along with fixes for some new
GCC-10 warnings
Math Libraries
* SP: Thumb implementation that works with clang
* SP math all: sp_cmp handling of negative values
* SP C ECC: mont sub - always normalize after sub before check for add
* TFM math library prime checking, added more error checks with small stack
build
* Sanity checks on 0 value with GCD math function
* fp_exptmod_ct error checking and small stack variable free on error
* Sanity check on supported digit size when calling mp_add_d in non fastmath
builds
* Support for mp_dump with SP Math ALL
* WOLFSSL_SP_NO_MALLOC for both the normal SP build and small SP build now
* WOLFSSL_SP_NO_DYN_STACK added for SP small code that is not small stack
build to avoid dynamic stack
PKCS 7/8
* wc_PKCS7_DecodeCompressedData to optionally handle a packet without content
wrapping
* Added setting of content type parsed with PKCS7
wc_PKCS7_DecodeAuthEnvelopedData and wc_PKCS7_DecodeEnvelopedData
* PKCS8 code improvements and refactoring
Misc.
* Sanity checks on null inputs to the functions wolfSSL_X509_get_serialNumber
and wolfSSL_X509_NAME_print_ex
* Added ARM CryptoCell support for importing public key with
wc_ecc_import_x963_ex()
* Improved checking for possible use of key->dp == NULL cases with ECC
functions
* Updated SHAKE256 to compile with NIST FIPS 202 standard and added support
for OID values (thanks to strongX509)
* Improved ECC operations when using WOLFSSL_NO_MALLOC
* Added WOLFSSL_SNIFFER_FATAL_ERROR for an return value when sniffer is in a
fatal state
* Allow parsing spaces in Base64_SkipNewline
* Issue callback when exceeding depth limit rather than error out with
OPENSSL_EXTRA build
* Added NXP LTC RSA key generation acceleration
For additional vulnerability information visit the vulnerability page at
https://www.wolfssl.com/docs/security-vulnerabilities/
See INSTALL file for build instructions.
More info can be found on-line at https://wolfssl.com/wolfSSL/Docs.html
If this ever worked it only did by accident. Specifying, for example,
"-arch arm64" as used on macOS is enough to break its custom configure
script that assumes all arguments start with "-".
The flags seem to propogate through the environment normally.
Upstream changes:
1.54 June 3, 2021
* Removed a superfluous call to makerandom_itv() thanks to Larry
Leszczynski <larryl@emailplus.org>.
* Improved makerandom_itv test to ensure generated numbers are in the
intterval.
* Actually include t/chisquare.t
Upstream changes:
0.033 2021-05-01
- fix#31 verify_xxx options do not work properly with decode_payload=0
0.032 2021-03-18
- fix#30 use lower uid/gid in release tarball
0.031 2021-01-10
- fix#29 Broken JWS support for ES256K "alg" type
0.030 2021-01-08
- fix#28 Using "kid_keys" with PS256 fails
Release v1.6.14: Meyer (Patch 14)
Support for 32-bit Windows python
Enable specification of krb5-config via environment variable
Support for GSS_C_CHANNEL_BOUND_FLAG
Support for docs build with sphinx 4
Fix undefined variable in get_all_statuses()
Add support for str objects in the cred store dict
Requests is an HTTP library, written in Python, for human beings.
This library adds optional GSSAPI authentication support and supports
mutual authentication.
Fix packaging on 32-bit platforms by disabling int128 dependency.
3.04 Mon 17 May 2021 10:58:37 AM EDT
- Fixed bug involving manually-specified IV not being used in some circumstances.
Release 2.7.0 (19 Jun 2021)
Added support for the ProxyCommand config file option and a corresponding proxy_command argument in the SSH connection options, allowing a subprocess to be used to make the connection to the SSH server. When the config option is used, it should be fully compatible with OpenSSH percent expansion in the command to run.
Added support for accessing terminal information as properties in the SSHServerProcess class. As part of this change, both the environment and terminal modes are now available as read-only mappings. Thanks again to velavokr for suggesitng this and submitting a PR with a proposed version of the change.
Fixed terminal information passed to pty_requested() callback to properly reflect requested terminal type, size, and modes. Thanks go to velavokr for reporting this issue and proposing a fix.
Fixed an edge case where a connection object might not be cleaned up properly if the connection request was cancelled before it was fully established.
Fixed an issue where some unit tests weren’t properly closing connection objects before exiting.
0.6.2 - 2021-06-27
Changed:
- Bump the Rust version in Dockerfile
- Use entrypoint for the docker container
- Update the docker command for quickly launching the app
0.6.1 - 2021-06-26
Changed:
- Run the container as non-root/dedicated user
- Update the docker alias in README.md
0.6.0 - 2021-06-25
Added:
- Support importing keys from the clipboard (#3)
- Add git-cliff configuration file
Changed:
- Update the keyserver link
Fixed:
- Apply clippy lints
- Update application command tests
## 2.6.6 (2021-06-11)
### Fixed
- Fix focusing search when pressing hotkey [#6603]
- Trim whitespace from TOTP key input prior to processing [#6604]
- Fix building on macOS [#6598]
- Resolve compiler warnings for unused return values [#6607]
## 2.6.5 (2021-06-07)
### Added
- Show search bar when toolbar is hidden or in overflow [#6279]
- Show countdown for clipboard clearing in status bar [#6333]
- Command line option to lock all open databases [#6511]
- Allow CSV import of bare TOTP secrets [#6211]
- Retain file creation time when saving database [#6576]
- Set permissions of saved attachments to be private to the current user [#6363]
- OPVault: Use Text instead of Name for attribute names [#6334]
### Changed
- Reports: Allow resizing of reports columns [#6435]
- Reports: Toggle showing expired entries [#6534]
- Save Always on Top setting [#6236]
- Password generator can exclude additional lookalike characters (6/G, 8/B) [#6196]
### Fixed
- Allow setting MSI properties in unattended install [#6196]
- Update MainWindow minimum size to enable smaller verticle space [#6196]
- Use application font size when setting default or monospace fonts [#6332]
- Fix notes not clearing in entry preview panel in some cases [#6481]
- macOS: Correct window activation when restoring from tray [#6575]
- macOS: Better handling of minimize after unlock when using browser integration [#6338]
- Linux: Start after the system tray is available on LXQt [#6216]
- Linux: Allow selection of modal dialogs on X11 in Auto-Type [#6204]
- KeeShare: prevent crash when file extension is missing [#6174]
2020-10-27: Hitch 1.7.0 released. This introduces support for PROXYv2 in --proxy-proxy mode,
adds new command line switches for various settings, and fixes a bug relating to an imbalance
in worker process load distribution, among other things. See the changelog for more information.
2020-08-31: Hitch 1.6.1 released. Fixes an issue in the PROXYv2 handling where we sometimes would
transmit the wrong 'verify' status for client certificate verification. (changelog)
3.1.1 (2021-05-31)
------------------
OAuth2.0 Provider - Bugfixes
* Fix acceptance of valid IPv6 addresses in URI validation
OAuth2.0 Client - Bugfixes
* Base OAuth2 Client now has a consistent way of managing the `scope`: it consistently
relies on the `scope` provided in the constructor if any, except if overridden temporarily
in a method call. Note that in particular providing a non-None `scope` in
`prepare_authorization_request` or `prepare_refresh_token` does not override anymore
`self.scope` forever, it is just used temporarily.
* MobileApplicationClient.prepare_request_uri and MobileApplicationClient.parse_request_uri_response,
ServiceApplicationClient.prepare_request_body,
and WebApplicationClient.prepare_request_uri now correctly use the default `scope` provided in
constructor.
* LegacyApplicationClient.prepare_request_body now correctly uses the default `scope` provided in constructor
OAuth2.0 Provider - Bugfixes
* client_credentials grant: fix log message
* OpenID Connect Hybrid - fix nonce not passed to add_id_token
* Different prompt values are now handled according to spec (e.g. prompt=none)
* OpenID Connect - fix Authorization: Basic parsing
General
* improved skeleton validator for public vs private client
* replace mock library with standard unittest.mock
* build isort integration
* python2 code removal
* add python3.8 support
* bump minimum versions of pyjwt and cryptography
mdigest reads the files from the argument list and computes a message
digest hash for the file content.
If the argument list is empty mdigest reads from standard in.
