Michael Tremer
eb68e27dd2
pakfire: Import key when system boots up
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-19 19:44:50 +00:00
Michael Tremer
5876642d17
ffmpeg: Ship libraries correctly
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-19 18:07:49 +00:00
Matthias Fischer
27ef66c26c
hdparm: Update to 9.55
...
Changelogs against 9.53:
"hdparm-9.55:
- added #include <sys/sysmacros.h> for major()/minor() macros
hdparm-9.54:
- Partial revert of Jmicron changes, from Jan Friesse."
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-19 11:56:35 +00:00
Matthias Fischer
71e5a29c81
dmidecode 3.1: Added patch (Fix firmware version of TPM device)
...
For details see:
http://git.savannah.gnu.org/cgit/dmidecode.git/commit/?id=174387405e98cd94c627832ae23abcb9be7e5623
"Both the operator (detected by clang, reported by Xorg) and the mask
for the minor firmware version field of TPM devices were wrong."
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-19 11:56:19 +00:00
Matthias Fischer
9e9fdb39e6
unbound: Update to 1.7.0
...
For details see:
http://www.unbound.net/download.html
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-18 13:49:40 +00:00
Matthias Fischer
399c2f9ccc
logrotate: Update to 3.14.0
...
For details see:
https://github.com/logrotate/logrotate/releases
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-18 13:44:27 +00:00
Matthias Fischer
4e316ae0a0
htop: Update to 2.1.0
...
For details see:
https://hisham.hm/htop/index.php?page=downloads
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-18 13:44:25 +00:00
Matthias Fischer
9051f3c9d7
bind: Update to 9.11.3
...
For details see:
http://ftp.isc.org/isc/bind9/9.11.3/RELEASE-NOTES-bind-9.11.3.html
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-18 13:44:19 +00:00
Matthias Fischer
1c1c1ac238
nano: Update to 2.9.4
...
For details see:
https://www.nano-editor.org/news.php
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-18 13:44:14 +00:00
Matthias Fischer
8aeec0ba89
rsync: Update to 3.1.3
...
For details see:
https://download.samba.org/pub/rsync/src/rsync-3.1.3-NEWS
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-18 13:44:12 +00:00
Erik Kapfer
cdc1a0e901
OpenVPN: Update to version 2.4.5
...
This is primarily a maintenance release, with further improved OpenSSL 1.1 integration, several minor bug fixes and other minor improvements.
Further information can be found in here https://github.com/OpenVPN/openvpn/blob/release/2.4/Changes.rst#version-245 and
here https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24 .
Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-16 14:38:02 +00:00
Stephan Feddersen
f0e9ed78a2
WIO: increment PAK_VER
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-09 15:39:56 +00:00
Stephan Feddersen via Development
a25c95b3a0
WIO: Update to Version 1.3.2 several changes in many files
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-09 15:39:48 +00:00
Matthias Fischer
d536c178ec
ntp: Update to 4.2.8p11
...
For details see:
http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities
"This release addresses five security issues in ntpd:
LOW/MEDIUM: Sec 3012 / CVE-2016-1549 / VU#961909: Sybil vulnerability: ephemeral
association attack
While fixed in ntp-4.2.8p7, there are significant additional protections for
this issue in 4.2.8p11.
Reported by Matt Van Gundy of Cisco.
INFO/MEDIUM: Sec 3412 / CVE-2018-7182 / VU#961909: ctl_getitem(): buffer read overrun
leads to undefined behavior and information leak
Reported by Yihan Lian of Qihoo 360.
LOW: Sec 3415 / CVE-2018-7170 / VU#961909: Multiple authenticated ephemeral associations
Reported on the questions@ list.
LOW: Sec 3453 / CVE-2018-7184 / VU#961909: Interleaved symmetric mode cannot recover
from bad state
Reported by Miroslav Lichvar of Red Hat.
LOW/MEDIUM: Sec 3454 / CVE-2018-7185 / VU#961909: Unauthenticated packet can reset
authenticated interleaved association
Reported by Miroslav Lichvar of Red Hat.
one security issue in ntpq:
MEDIUM: Sec 3414 / CVE-2018-7183 / VU#961909: ntpq:decodearr() can write beyond its
buffer limit
Reported by Michael Macnair of Thales-esecurity.com.
and provides over 33 bugfixes and 32 other improvements."
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-07 18:44:04 +00:00
Matthias Fischer
cc4816a1af
clamav 0.99.4: removed gcc patch
...
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-07 18:43:44 +00:00
Peter Müller
9d5e5eb012
Tor: update to 0.3.2.10
...
Update Tor to 0.3.2.10, which fixes some security and DoS
issues especially important for relays.
The release notes are available at:
https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915
Signed-off-by: Peter Müller <peter.mueller@link38.eu >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
Fixes : #11662
2018-03-05 15:12:28 +00:00
Peter Müller
a12d488682
ClamAV: update to 0.99.4
...
Update ClamAV to 0.99.4 which fixes four security issues
and compatibility issues with GCC 6 and C++ 11.
The release note can be found here: http://blog.clamav.net/2018/03/clamav-0994-has-been-released.html
Signed-off-by: Peter Müller <peter.mueller@link38.eu >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-05 15:11:55 +00:00
Michael Tremer
263d1e6484
openssl: Apply ciphers patch before running Configure
...
This works just fine here.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-28 11:49:47 +00:00
Peter Müller via Development
5929493445
set OpenSSL 1.1.0 DEFAULT cipher list to secure value
...
Only use secure cipher list for the OpenSSL DEFAULT list:
* ECDSA is preferred over RSA since it is faster and more scalable
* TLS 1.2 suites are preferred over anything older
* weak ciphers such as RC4 and 3DES have been eliminated
* AES-GCM is preferred over AES-CBC (known as "mac-then-encrypt" problem)
* ciphers without PFS are moved to the end of the cipher list
This patch leaves AES-CCM, AES-CCM8 and CHACHA20-POLY1305 suites
where they are since they are considered secure and there is no
need to change anything.
The DEFAULT cipher list is now (output of "openssl ciphers -v"):
ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD
ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD
ECDHE-ECDSA-AES256-CCM8 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESCCM8(256) Mac=AEAD
ECDHE-ECDSA-AES256-CCM TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESCCM(256) Mac=AEAD
ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(128) Mac=AEAD
ECDHE-ECDSA-AES128-CCM8 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESCCM8(128) Mac=AEAD
ECDHE-ECDSA-AES128-CCM TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESCCM(128) Mac=AEAD
ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA384
ECDHE-ECDSA-CAMELLIA256-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=Camellia(256) Mac=SHA384
ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA256
ECDHE-ECDSA-CAMELLIA128-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=Camellia(128) Mac=SHA256
ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD
ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD
ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD
ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA384
ECDHE-RSA-CAMELLIA256-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=Camellia(256) Mac=SHA384
ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA256
ECDHE-RSA-CAMELLIA128-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=Camellia(128) Mac=SHA256
DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(256) Mac=AEAD
DHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=DH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD
DHE-RSA-AES256-CCM8 TLSv1.2 Kx=DH Au=RSA Enc=AESCCM8(256) Mac=AEAD
DHE-RSA-AES256-CCM TLSv1.2 Kx=DH Au=RSA Enc=AESCCM(256) Mac=AEAD
DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(128) Mac=AEAD
DHE-RSA-AES128-CCM8 TLSv1.2 Kx=DH Au=RSA Enc=AESCCM8(128) Mac=AEAD
DHE-RSA-AES128-CCM TLSv1.2 Kx=DH Au=RSA Enc=AESCCM(128) Mac=AEAD
DHE-RSA-AES256-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(256) Mac=SHA256
DHE-RSA-CAMELLIA256-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=Camellia(256) Mac=SHA256
DHE-RSA-AES128-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(128) Mac=SHA256
DHE-RSA-CAMELLIA128-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=Camellia(128) Mac=SHA256
ECDHE-ECDSA-AES256-SHA TLSv1 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA1
ECDHE-ECDSA-AES128-SHA TLSv1 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA1
ECDHE-RSA-AES256-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1
ECDHE-RSA-AES128-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1
DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1
DHE-RSA-CAMELLIA256-SHA SSLv3 Kx=DH Au=RSA Enc=Camellia(256) Mac=SHA1
DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1
DHE-RSA-CAMELLIA128-SHA SSLv3 Kx=DH Au=RSA Enc=Camellia(128) Mac=SHA1
AES256-GCM-SHA384 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(256) Mac=AEAD
AES256-CCM8 TLSv1.2 Kx=RSA Au=RSA Enc=AESCCM8(256) Mac=AEAD
AES256-CCM TLSv1.2 Kx=RSA Au=RSA Enc=AESCCM(256) Mac=AEAD
AES128-GCM-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(128) Mac=AEAD
AES128-CCM8 TLSv1.2 Kx=RSA Au=RSA Enc=AESCCM8(128) Mac=AEAD
AES128-CCM TLSv1.2 Kx=RSA Au=RSA Enc=AESCCM(128) Mac=AEAD
AES256-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA256
CAMELLIA256-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=Camellia(256) Mac=SHA256
AES128-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA256
CAMELLIA128-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=Camellia(128) Mac=SHA256
AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
CAMELLIA256-SHA SSLv3 Kx=RSA Au=RSA Enc=Camellia(256) Mac=SHA1
AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1
CAMELLIA128-SHA SSLv3 Kx=RSA Au=RSA Enc=Camellia(128) Mac=SHA1
This has been discussed at 2017-12-04 (https://wiki.ipfire.org/devel/telco/2017-12-04 )
and for a similar patch written for OpenSSL 1.0.x.
Signed-off-by: Peter Müller <peter.mueller@link38.eu >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-28 11:45:03 +00:00
Michael Tremer
ca4c354e08
Bump release of all packages linked against OpenSSL
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-26 16:28:16 +00:00
Michael Tremer
87484f5c78
openssl-compat: Do not try to apply missing padlock patch
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-22 18:52:03 +00:00
Michael Tremer
b9c56c9e9c
openssl-compat: Add missing library path
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-22 18:50:38 +00:00
Michael Tremer
c2646dff80
Revert "wget: Link against GnuTLS instead of OpenSSL"
...
This reverts commit a46b159a8d .
wget 1.19.4 supports linking against OpenSSL 1.1.0.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-21 12:55:36 +00:00
Michael Tremer
9434bffaf2
Merge branch 'openssl-11' into next
2018-02-21 12:21:10 +00:00
Michael Tremer
ea3b9a4f88
strongswan: Update to 5.6.2
...
Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS
signatures that was caused by insufficient input validation.
One of the configurable parameters in algorithm identifier
structures for RSASSA-PSS signatures is the mask generation
function (MGF). Only MGF1 is currently specified for this purpose.
However, this in turn takes itself a parameter that specifies
the underlying hash function. strongSwan's parser did not
correctly handle the case of this parameter being absent,
causing an undefined data read.
This vulnerability has been registered as CVE-2018-6459.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-19 23:46:17 +00:00
Michael Tremer
e36a7e3cf2
haproxy: Link against libatomic on ARM
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-17 13:36:37 +00:00
Michael Tremer
429af17883
i2c-tools: New package
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-16 20:01:55 +00:00
Michael Tremer
0f354672a2
flac: Update to 1.3.2
...
The previous version fails to build on i586
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-16 19:14:33 +00:00
Michael Tremer
909ba0ad4a
nagios-plugins: Update rootfiles
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-13 16:30:24 +00:00
Michael Tremer
97b5588cf3
zlib: Fix name of logfile in toolchain build
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-13 10:24:04 +00:00
Michael Tremer
05551f7bdb
sslh: Build without tcpwrappers
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-13 10:23:54 +00:00
Michael Tremer
54d5414848
toolchain: Add zlib
...
ccache needs this and usually comes with an own bundled
version but fails to build in version 3.4.1.
Since this is a small library only and we really want
ccache to use compression, we will build this indepently
and let ccache use it from the system.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-12 14:24:12 +00:00
Michael Tremer
2dd9f3b379
Cleanup toolchain scripts
...
No functional changes, just some tidy up
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-12 12:44:37 +00:00
Michael Tremer
d32233aa1b
ccache: Update to 3.4.1
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-12 12:12:08 +00:00
Michael Tremer
71196131be
PAM: Drop shipped configuration
...
This is outdated, broken and has hardcoded passwords.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-12 12:09:22 +00:00
Michael Tremer
71cf8c8a6f
Drop perl-DBD-mysql
...
This package is not used by anything and depends on MySQL
which has been dropped, too.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-12 12:07:29 +00:00
Michael Tremer
2d5940daca
Drop MySQL
...
This is outdated and still on 5.0.x and nobody volunteered to
update this package.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-12 12:05:46 +00:00
Michael Tremer
c4713705d1
asterisk: Do not depend on MySQL any more
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-12 12:02:51 +00:00
Michael Tremer
4fcf8acfea
postfix: Don't depend on amavis
...
This can be used together but there is no need to
always install amavis when someone wants to use postfix
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-12 11:52:07 +00:00
Michael Tremer
db116a33d6
postfix: Don't depend on MySQL any more
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-12 11:51:46 +00:00
Michael Tremer
abf2b05474
postfix: Don't ship our own configuration
...
This is outdated and half of it is not maintained any more.
Users should configure postfix themselves based on the
default configuration.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-12 11:50:51 +00:00
Michael Tremer
3e8ce0dd86
Drop pammysql
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-12 11:44:28 +00:00
Michael Tremer
e3e17107ba
Drop tcpwrapper
...
This library has been unused for quite a while
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-12 11:42:47 +00:00
Michael Tremer
a350ea6dea
Drop mISDN userspace tools
...
This is unsupported for quite a while and nobody should be using this.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-12 11:41:50 +00:00
Michael Tremer
922ec43f99
Drop capi4k-utils
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-12 11:33:51 +00:00
Erik Kapfer
bd42f9f968
CRL updater: Update script for OpenVPNs CRL
...
Update script for OpenVPNs CRL cause OpenVPN refactors the CRL handling since v.2.4.0 .
Script checks the next update field from the CRL and executes an update before it expires.
Script is placed under fcron.daily for daily checks.
Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-11 22:20:28 +00:00
Michael Tremer
59d77d2eae
openssl: Properly pass CFLAGS and LDFLAGS to build
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-11 22:19:45 +00:00
Michael Tremer
11e78f38b9
Package openssl-compat (1.0.2.n)
...
This is provided for compatibility with binaries that have
been compiled against this version of OpenSSL.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-11 22:19:45 +00:00
Erik Kapfer
3b83dffc19
OpenVPN: Update to version 2.4.4
...
Changed LFS and ROOTFILE for OpenVPN 2.4.4 update.
Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-11 22:19:45 +00:00
Michael Tremer
8b87254a02
python-m2crypto: Install in correct directory
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-11 22:19:45 +00:00