libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field…
libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to cor…
libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that …
libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_p…
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the…
libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious S…
libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allow…
libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out…
libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap meta…
A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation …
VuXML only (0)
Listed in VuXML, the packaged version 1.11.1_1,3 is still in the affected range; pkg audit reports it. What does this mean?
None.
Fixed (2)
Show 2 fixed
VuXML entries whose affected range the packaged version has left.
security/libssh2: Remove zlib leftover menu option definition
Remove zlib definition from OPTIONS_DEFAULT as there's no port logic left
Approved by: blanket
security/libssh2: Update to 1.11.1
* Update MASTER_SITES, use GitHub as primary and upstream main website as fallback
* Fixes CVE-2023-48795
* Convert to CMake for faster builds and cleaner port Makefile
* Make static library option (non default)
* Enable OpenSSL support by default (optional)
PR: 282147
Approved by: portmgr (maintainer timeout, 2+ weeks)
security/libssh2: Import upstream libressl-3.5 fix
Backport upstream commit instead of using own local patch. Also bump
port revision, it will change the binary when built with libressl.
Approved by: sbz (maintainer, timeout), tcberner (mentor)
Differential Revision: https://reviews.freebsd.org/D37278
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
security/libssh2: fix the GCRYPT option
The port uses the old crypto configure flags:
--with-libgcrypt and --with-openssl. These flags
are no longer supported.
Besides from the obvious effect of the actual port configuration
not matching user intent, it also produces incorrect pkg-config
file for the given set of dependencies, and other ports that
depend on libssh2 fail when it's configured with GCRYPT=on.
Fix by using the proper configure arguments:
--with-crypto=libgcrypt and --with-crypto=openssl.
PR: 248164
Submitted by: dgilbert@eicat.ca (bug report), James French (patch)
Approved by: maintainer timeout
security/libssh2: fix build on GCC architectures and check-plist
Add USES=compiler:c11 to fix build on GCC architectures.
While here, also add two missing manpages to fix make check-plist.
Add support for ECDSA key exchange and SHA256 MAC.
Note these patches were cherry-piecked from the following upstream commits:
https://github.com/libssh2/libssh2/commit/bbc43cb
https://github.com/libssh2/libssh2/commit/aba34f5
https://github.com/libssh2/libssh2/commit/62b825c
Submitted by: Andrew Heybey <ath@heybey.org>
Reviewed by: sbz (maintainer)
Assume "pkg-config --static zlib" works after 9.x EOL
Many hacks simply removed dependency on zlib which broke static linking
if it was actually supported.
Fix usage of WITH_OPENSSL_BASE, WITH_OPENSSL_PORT and OPENSSL_PORT.
WITH_OPENSSL_* can't be set after bsd.port.pre.mk.
Fold all other usage into using SSL_DEFAULT == foo
PR: 210149
Submitted by: mat
Exp-run by: antoine
Sponsored by: The FreeBSD Foundation, Absolight
Differential Revision: https://reviews.freebsd.org/D6577
By default libtool replaces -export-symbols <file> with -retain-symbols-file <file> on ELF systems, but this doesn't really do what -export-symbols is meant to do. On GNU ELF systems it converts <file> to a simple version script first and then uses -version-script instead of -retain-symbols-file. Let USES=libtool patch libtool scripts to do this on all systems with GNU ld(1).
Bump PORTREVISION on all ports where the build log contains -export-symbols.
audio/calf: This port builds a module that now exports only one function,
but it also builds a number of executables that link to this module and
expect to see other functions. Because it's already a bit dodgy to link to
a module (libtool warns about this) let the module continue to export only
one function and instead build an ordinary library from the same source that
the executables can link to. Fix a number of other issues in the same
Makefile.am and clean up the port Makefile.
japanese/scim-honoka: Tries to hide all symbols that start with an
underscore, but because this library is written in C++ all symbols start
with _Z so it ends up hiding everything. Just don't hide anything at all
like the textproc/scim configure script does.
multimedia/schroedinger: Apply an upstream patch.
textproc/scim-input-pad: Same as japanese/scim-honoka.
PR: 201922
Approved by: portmgr (antoine)
Exp-run by: antoine
security/libgcrypt: 1.6.1 -> 1.6.2, bump depends
Changes:
- src/sexp.c (do_vsexp_sscan): Return error for invalid args.
- cipher/md.c (_gcry_md_info): Fix a segv in case of calling
with wrong parameters.
- cipher/primegen.c (_gcry_generate_elg_prime): Change to return an
error code, possible NULL deref in call to prime generator.
- cipher/dsa.c (generate): Take care of new return code.
- cipher/elgamal.c (generate): Change to return an error code. Take
care of _gcry_generate_elg_prime return code.
- ecc: Support the non-standard 0x40 compression flag for EdDSA.
- mpi: Extend the internal mpi_get_buffer.
- mpi: Fix regression for powerpc-apple-darwin detection.
- Fix bug inhibiting the use of the sentinel attribute in src/gcrypt.h.in
- Fix building for the x32 target without asm modules in
mpi/generic/mpi-asm-defs.h: Use a fixed value for the x32 ABI.
- Fix ARM assembly when building __PIC__
- mpi: Fix a subtle bug setting spurious bits with in mpi_set_bit.
* mpi/mpi-bit.c (_gcry_mpi_set_bit, _gcry_mpi_set_highbit): Clear
allocated but not used bits before resizing.
* tests/t-mpi-bits.c (set_bit_with_resize): New.
- Use internal malloc function in fips.c.
* src/fips.c (check_binary_integrity): s/gcry_malloc/xtrymalloc/.
- pubkey: Re-map all deprecated RSA algo numbers.
- cipher: Fix possible NULL dereference in cipher/md.c for being NULL.
- Fix ARMv6 detection when CFLAGS modify target CPU architecture.
PR: 193264
Approved by: cpm@fbsd.es (maintainer)
security/libssh2: - Convert to USES=libtool and USES=pathfix - Add INSTALL_TARGET=install-strip - Only depend on openssl if GCRYPT option is off - Sanitize libssh2.pc
devel/libvirt:
- Remove workaround for broken libssh2.pc
- Add USES=libtool and bump dependent ports
- Convert to INSTALL_TARGET=install-strip
devel/libvirt-glib:
- Convert to USES=libtool
Approved by: portmgr (implicit, bump unstaged port)