- private key format has been udpated and now uses Argon2
- new algorithms; Curve448 kex, Ed448 pub keys, SHA-2 RSA variants
- pageant permits loading an encrypted private key and only giving the
passphrase later when it's used
https://lists.tartarus.org/pipermail/putty-announce/2021/000031.html
Use OpenSSL 1.1.1 code path that uses SSL_CTX_up_ref() instead of
handrolling it. This way mosquitto will continue to build after
an upcoming libssl bump.
Executables were installed mode 774 owned by root:bin. We need to use
mode 775 (o+x), otherwise nagios which runs as user _nagios complains:
Error: failed to access() /usr/local/bin/nagios: Permission denied
Error: Spawning workers will be impossible. Aborting.
Solution discussed and found together with sthen and tb.
ok sthen@ tb@
- no need to disable SSLv2 and SSLv3
- no need to initialize the libraries explicitly anymore
- remove incomplete uninit code
- use TLS_method() instead of SSLv23_client_method()
from Brad
this please test and report back if you see problems; in the run-up
to OpenBSD 6.9 we dropped back to 9.16.10 due to problems in interim
releases
CVE-2021-25214: A broken inbound incremental zone update (IXFR)
can cause named to terminate unexpectedly
https://kb.isc.org/docs/cve-2021-25214
CVE-2021-25215: An assertion check can fail while answering queries for
DNAME records that require the DNAME to be processed to resolve itself
https://kb.isc.org/docs/cve-2021-25215
CVE-2021-25216: A second vulnerability in BIND's GSSAPI security policy
negotiation can be targeted by a buffer overflow attack
https://kb.isc.org/docs/cve-2021-25216
When missing, samba builds pytdb support using its bundled copy of tdb,
and installs it in WRKINST, as shown by update-plist. samba runs fine
with the py-tdb package registered in its RUN_DEPENDS, but this is not
what was intended. Consistently use libtdb and py-tdb from databases/tdb.
Broken since ~2018 on clang+ld.lld archs, no analysis and no diff to fix
it, so it's time to send it to the Attic. Support for AD DC mode can't
be optimal anyway, with the deprecation of the ntvfs server code and our
lack of xattrs/ACLs.
"Fine by me" Ian
