Commit Graph

37178 Commits

Author SHA1 Message Date
Tom Hukins 654132caa4 security/vuxml: correct "vulnerabilities" spelling
Closes:	https://github.com/freebsd/freebsd-ports/pull/164
2023-02-25 09:01:24 +00:00
Bernard Spil 403dd0df18 security/nextcloud-twofactor_webauthn: Update to 1.1.1 2023-02-24 19:11:03 +00:00
Bernard Spil a0a1e04842 security/nextcloud-twofactor_nextcloud_notification: Update to 3.6.0 2023-02-24 19:10:49 +00:00
Dan Langille 9901de6d9f security/snort3: Update to 3.1.56.0
Relnotes: https://github.com/snort3/snort3/releases/tag/3.1.56.0

Approved by:	maintainer (via private email)
2023-02-24 14:20:35 +00:00
Fernando Apesteguía a9185f053f security/vuxml: document vulnerabilities for net/freerdp
CVE-2022-39282 and CVE-2022-39283.

PR:		269667
Reported by:	grahamperrin@freebsd.org
2023-02-24 14:36:11 +01:00
Robert Clausecker 3a9acb2b4d security/libpki: unbreak (again) on armv7
Apparently both arm and armv? are now needed to correctly handle
arm targets.

Fixes:		fae3c318a10e6fc9870fd1f2a41611ceafe11cc4
Approved by:	flo (mentor)
Differential Revision: https://reviews.freebsd.org/D38726
2023-02-24 09:50:34 +01:00
Robert Clausecker ffba4d2517 security/0d1n: fix build
- convert static REINPLACE_CMD to patch files as per policy
 - remove remaining <alloca.h> uses
 - patch getopt_long use on targets where char is unsigned
 - work around missing __GNUC_PREREQ macro
 - fix other missing includes
 - update pkg-plist to what the maintainer intended to pack
 - patch /opt/0d1n to ${DATADIR} in the relevant files
 - note that project is dual licensed (upstream has since
   removed the GPLv3 license)
 - define LICENSE_FILE_{GPLv3,BSD3CLAUSE}

PR:		269717
Fixes:		88dd085ff7
Approved by:	portmgr (build fix blanket)
Approved by:	flo (mentor)
Differential Revision: https://reviews.freebsd.org/D38725
2023-02-24 09:50:04 +01:00
Larry Rosenman e13a990b9a security/1password-client2: update to 2.14.0
ChangeLog:
https://app-updates.agilebits.com/product_history/CLI2#v2140001
2023-02-23 12:52:09 -06:00
Larry Rosenman d2d800ac74 security/1password-client2-beta: update to 2.15.0-beta.03
ChangeLog:
https://app-updates.agilebits.com/product_history/CLI2#v2150003

you will need to check the "show betas" check box to see this release.
2023-02-23 12:52:07 -06:00
Alexey Dokuchaev 6074b736de security/pks: unbreak the build against modern OpenSSL
Garbage-collect nowadays useless USE_GCC=yes while here.
2023-02-23 10:06:50 +00:00
Robert Nagy e132bf708a security/vuxml: add www/*chromium < 110.0.5481.177
Approved by:	rene (mentor)
Obtained from:	https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html
2023-02-23 07:17:11 +01:00
Ashish SHUKLA 1925a00484 security/tailscale: Update to 1.36.2 2023-02-23 01:03:57 +00:00
Piotr Kubaj 2716b66722 security/john: merge upstream patch for powerpc64 build failure
Allows to drop -mvsx.
2023-02-22 21:51:40 +01:00
Tobias C. Berner 1ebe03f677 security/kleopatra: fix build (std::ranges::subrange is not available) 2023-02-22 19:06:50 +01:00
Antoine Brodin 031c26fb43 security/metasploit: fix dependencies 2023-02-22 15:25:18 +00:00
Antoine Brodin 3c27fcfc12 security/rubygem-rex-text: update to 0.2.49 2023-02-22 15:24:12 +00:00
Antoine Brodin 33cabcfb08 security/rubygem-rex-sslscan: update to 0.1.9 2023-02-22 15:23:45 +00:00
Antoine Brodin 755ae47d14 security/rubygem-rex-socket: update to 0.1.47 2023-02-22 15:23:24 +00:00
Antoine Brodin ee83a01417 security/rubygem-rex-random_identifier: update to 0.1.10 2023-02-22 15:23:01 +00:00
Antoine Brodin 5bf3b8815d security/rubygem-rex-powershell: update to 0.1.97 2023-02-22 15:22:38 +00:00
Antoine Brodin 7f8476552e security/rubygem-rex-exploitation: update to 0.1.37 2023-02-22 15:22:16 +00:00
Antoine Brodin 157a4247b0 security/rubygem-rex-core: update to 0.1.30 2023-02-22 15:21:00 +00:00
Antoine Brodin 0dfafcaea2 security/rubygem-metasploit_payloads-mettle: update to 1.0.20 2023-02-22 15:21:00 +00:00
Antoine Brodin 769b53b93a security/rubygem-metasploit_data_models: update to 5.0.6 2023-02-22 15:21:00 +00:00
Antoine Brodin 8bc0ef92ec security/rubygem-metasploit-payloads: update to 2.0.97 2023-02-22 15:20:59 +00:00
Antoine Brodin ce86d58d1d security/rubygem-metasploit-credential: update to 5.0.9 2023-02-22 15:20:59 +00:00
Antoine Brodin 8910e56f8b security/rubygem-metasploit-concern: update to 4.0.5 2023-02-22 15:20:59 +00:00
Antoine Brodin e52f3496d1 security/py-dfdatetime: update to 20221218 2023-02-22 14:15:49 +00:00
Antoine Brodin ab0086a9a2 security/py-plaso: update to 20221229 2023-02-22 14:14:20 +00:00
Antoine Brodin 9e67c21e9a security/py-dfwinreg: update to 20221218 2023-02-22 14:14:20 +00:00
Antoine Brodin d03ef56959 security/py-dfvfs: update to 20221224 2023-02-22 14:14:19 +00:00
Antoine Brodin 2585695418 security/py-artifacts: update to 20221219 2023-02-22 14:14:19 +00:00
Kai Knoblich 6269f0e5c5 security/py-netbox-secretstore: Update to 1.4.1
* Remove no longer required patch.

Changelog since 1.3.0:

https://github.com/DanSheps/netbox-secretstore/compare/v1.3.0...v1.4.1

MFH:		No (not compatible with NetBox 3.3.x)
2023-02-22 08:07:05 +01:00
Sergey A. Osokin c36ae8a9e3 security/boringssl: update to the recent commit
Update go modules.
2023-02-21 19:35:15 -05:00
Craig Leres 4e0e0f48d7 security/zeek: Update to 5.0.7
https://github.com/zeek/zeek/releases/tag/v5.0.7

This release fixes the following potential DoS vulnerabilities:

 - Receiving DNS responses from async DNS requests (via the
   lookup_addr, etc BIF methods) with the TTL set to zero could
   cause the DNS manager to eventually stop being able to make new
   requests.

 - Specially-crafted FTP packets with excessively long usernames,
   passwords, or other fields could cause log writes to use large
   amounts of disk space.

 - The find_all and find_all_ordered BIF methods could take extremely
   large amounts of time to process incoming data depending on the
   size of the input.

This release fixes the following bugs:

 - Various issues with signed/unsigned character discrepancies on
   arm64 builds are fixed.

 - A performance degredation in debug builds involving hashing large
   keys for Dictionaries was fixed.

Reported by:	Tim Wojtulewicz
Security:	7a425536-74f7-4ce4-9768-0079a9d44d11
2023-02-21 14:39:32 -08:00
Craig Leres 2986f76a64 security/vuxml: Mark zeek < 5.0.7 as vulnerable as per:
https://github.com/zeek/zeek/releases/tag/v5.0.7

This release fixes the following potential DoS vulnerabilities:

 - Receiving DNS responses from async DNS requests (via the
   lookup_addr, etc BIF methods) with the TTL set to zero could
   cause the DNS manager to eventually stop being able to make new
   requests.

 - Specially-crafted FTP packets with excessively long usernames,
   passwords, or other fields could cause log writes to use large
   amounts of disk space.

 - The find_all and find_all_ordered BIF methods could take extremely
   large amounts of time to process incoming data depending on the
   size of the input.

Reported by:	Tim Wojtulewicz
2023-02-21 14:37:24 -08:00
Koop Mast 4b6ef035f3 security/vuxml: Document libde265 vulnabilities.
PR:             269382
Reported by:    diizzy@
2023-02-21 21:57:38 +01:00
Tobias C. Berner 1aa6406f49 KDE: Update KDE Plasma Desktop to 5.27.1
Announcement:	https://kde.org/announcements/plasma/5/5.27.1
2023-02-21 20:41:52 +01:00
Antoine Brodin 8cf388184e security/silktools: update to 3.19.2 2023-02-21 19:27:22 +00:00
Cy Schubert d8aced6fc7 security/wpa_supplicant-devel: Update to latest GH commit
Update to the latest w1.fi commit, proxied through my GH account.
2023-02-21 08:08:48 -08:00
Renato Botelho 945cff6a56 security/vuxml: Document recent git CVEs
Document CVEs fixed by devel/git 2.39.1 and 2.39.2:

CVE-2022-41903
CVE-2022-23521
CVE-2023-22490
CVE-2023-23946
PR:		269655
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2023-02-21 08:37:19 -03:00
Robert Clausecker 46c865481f security/certmgr: fix build on riscv64
- bump golang.org/x/sys dependency to 0.5.0 to add
   missing riscv64-freebsd bits
 - remove lots of useless GH_TUPLE entries (these are
   already vendored in the upstream repository).
 - move REINPLACE_CMD to pre-configure to simplify
   make makepatch

Tested by:	dmgk
Approved by:	flo (mentor)
Sponsored by:	Berliner Linux User Group e.V.
Differential Revision: https://reviews.freebsd.org/D38684
2023-02-21 00:36:39 +01:00
Seyed Pouria Mousavizadeh Tehrani d24b8053f7 security/ssh-import-id: new port
You're logged onto a cloud instance working on a problem with your
fellow devs, and you want to invite them to log in and take a look
at these crazy log messages. What to do?

Oh. You have to ask them to cat their public SSH key, paste it into
IRC (wait, no, it's id_rsa.pub, not id_rsa silly!) then you copy it
and cat it to the end of authorized_hosts.

That's where ssh-import-id comes in. With ssh-import-id, you can add
the public SSH keys from a known, trusted online identity to grant
SSH access.

Currently supported identities include Github and Launchpad.

WWW: https://git.launchpad.net/ssh-import-id

Submitter is first time maintainer.

PR:		265835
Approved by:	flo (mentor)
Differential Revision: https://reviews.freebsd.org/D38681
2023-02-21 00:36:35 +01:00
Dries Michiels 7e46aecc6d security/i2pd: update to 2.46.1
Changes:	https://github.com/PurpleI2P/i2pd/releases/tag/2.46.1
2023-02-20 22:44:30 +01:00
Fernando Apesteguía 6eccdf24a6 security/crowdsec: update to 1.4.6
ChangeLog: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.4.6

 * strip v prefix in tag name in azure-pipeline
 * Fix azure pipeline
 * Use the tag name from the predefined variable for azure pipeline

PR:		269713
Reported by:	marco@crowdsec.net (maintainer)
2023-02-20 22:30:39 +01:00
Yuri Victorovich 474687b228 security/fizz: Update 2023.02.13.00 → 2023.02.20.00 2023-02-20 12:54:36 -08:00
Lewis Cook b9e670b2a0 security/osv-scanner: Update to 1.1.0
Changes:	https://github.com/google/osv-scanner/compare/v1.0.2...v1.1.0
2023-02-20 19:01:59 +00:00
Lewis Cook 87ea824e1c security/osv-scanner: Pin Go version to 1.19
Numerous packages currently do not support Go 1.20 yet,
and fail with the following:

version "go1.19.5" does not match go tool version "go1.20"

For now, pin the Go version used to 1.19, until upstream
supports 1.20.
2023-02-20 19:01:58 +00:00
Antoine Brodin 5beef0b781 security/p5-OpenCA-OpenSSL: deprecate 2023-02-20 17:09:28 +00:00
Antoine Brodin 91f21c0f44 security/pks: deprecate
it is broken with "recent" (newer than 2018) ssl
2023-02-20 14:42:08 +00:00