The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.
An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.
PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration console (which itself requires authorization) could run this command. It would have been correct to allow only users listed in the admin_users parameter.
VuXML only (0) · listed, port not fixed yet
None. pkg audit reports nothing for this version.
Fixed (2)
VuXML entries whose affected range this version has left.
databases/pgbouncer: Add default option MANPAGES
Port depends on hs-pandoc to build its manpages, that adds a dependency
on lang/ghc, which takes hours to build.
MANPAGES option save lots of build time for users who build their own
ports without MANPAGES.
While here fix build with custom USER/GROUP not from UIDs/GIDs.
PR: 295239
Approved by: Dmitry Wagin <dmitry.wagin@ya.ru> (maintainer, timeout 2 weeks)
Sponsored by: UNIS Labs
databases/pgbouncer: Update 1.23.1 => 1.24.1
Changelogs:
https://www.pgbouncer.org/changelog.html#pgbouncer-124x
While here replace non-ASCII quotes with ASCII in pkg-descr.
PR: 288502
databases/pgbouncer: add a graceful stop command to rc script
The user can now terminate pgbouncer both with gracefulstop
(sends SIGINT) and with stop (sends SIGTERM).
PR: 271023
databases/pgbouncer: Update to 1.18.0
Maintainer yields maintainership in favor of submitter, already maintainer of
several ports.
ChangeLog: https://www.pgbouncer.org/changelog.html#pgbouncer-118x
* Add application_name to SHOW CLIENTS/SERVERS/SOCKETS output
* Add information about cancel requests to SHOW CLIENTS/SERVERS/POOLS output
* Fail sbuf_send_pending operation if destination socket is closed
* Fix a few possible crashes
* Fix for overflow bug in comma-separated host list feature, causing
connection to get re-routed to Unix socket
* Don’t evict connections to achieve min_pool_size
* Fix SHOW HELP with PostgreSQL 15
* Fix race condition in query cancelation handling. It was possible that a
query cancellation for one client canceled a query for another one. This
could happen when a cancel request was received by PgBouncer when the query
it was meant to cancel already completed by itself.
* Various CI updates
PR: 269499
Reported by: dmitry.wagin@ya.ru
Approved by: m.tsatsenko@gmail.com (maintainer)
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
databases/pgbouncer: Fix config file
- No need to replace pgbouncer.log as the config mentions the absolute path
/var/log/pgbouncer/pgbouncer.log now
- No need to replace pgbouncer.pid as the config mentions the absolute path
/var/run/pgbouncer/pgbouncer.log now
- References to other files in /etc/ is changed with ${PREFIX}/etc specially
pgbouncer.users which had a reference to /etc directory
- No longer requires gsed so removed the BUILD_DEPENDS
- There was a pkg-message.in file which was not called using SUB_FILES; added
accordingly
PR: 259474
Approved by: m.tsatsenko@gmail.com (maintainer)
Sponsored by: Bounce Experts
databases/pgbouncer builds fine with OpenSSL 1.1.1 after r467201
http://beefy12.nyi.freebsd.org/data/head-amd64-default/p485718_s340864/logs/pgbouncer-1.8.1.log
devel/libevent2: update to 2.1.8 and cleanup
- DEFAULT_VERSIONS += ssl=openssl-devel is now supported
- devel/py-event and devel/p5-Event-Lib are marked BROKEN
Changes: https://github.com/libevent/libevent/raw/release-2.1.8-stable/whatsnew-2.1.txt
Changes: https://github.com/libevent/libevent/raw/release-2.1.8-stable/ChangeLog
PR: 216527
Exp-run by: antoine
Approved by: mm (maintainer)
.Fix build on 9.x.
Setting WITH_OPENSSL_PORT after including bsd.ports.pre.mk is a no-op, include
bsd.port.options.mk instead.
The 2016Q1 is unaffected by this bug.
PR: 207382
Submitted by: m.tsatsenko@gmail.com (maintainer)
databases/pgbouncer: Remove unnecessary dependency xmlto
It turns out that xmlto is not needed for documentation at all now.
The man pages are pregenerated and provided in the tarball.
PR: 192507
Reported by: dmitry2004 (yandex.ru)