Shibboleth 2.x relies on OpenSAML 2, which in turn requires this
lower-level library that provides a higher level interface to XML
processing, particularly in light of signing and encryption.
===> The following configuration options are available for xmltooling-3.3.0:
DOCS=on: Build and/or install documentation
===> Use 'make config' to modify these settings
devel/xmltooling: update to 3.2.4
An updated version of the XMLTooling library that is part of the
OpenSAML and Shibboleth Service Provider software is now available
which corrects a server-side request forgery (SSRF) vulnerability.
Security: f7e9a1cc-0931-11ee-94b4-6cc21735f730
shibboleth-sp: Update to 3.4.1
A patch release of the Service Provider, V3.4.1, is now available. This
release fixes a couple of small bugs and adds a warning requested by one
of our member organizations in the absence of the redirectLimit setting,
which leads to SPs being abused as open redirectors.
Notably, this release includes an update to the xmltooling library that
hardens the code base against the sorts of attacks reported against the
IdP in the recent advisory. The SP is, as far as can be determined, not
impacted directly by that vulnerability, but this is a precautionary
change.
Release
notes: https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335693/ReleaseNotes
security/shibboleth-sp: update to 3.4.0
This is a minor update containing a new setting suggested by a
contributor (thus the unplanned minor version change) controlling
retries when TCP connections to shibd are used. The other changes are
minimal in nature.
Update the toolchain as well:
devel/xmltooling
textproc/xerces-c3
and bump PORTREVISION for security/opensaml due to dependencies'
updates.
Release notes: https://wiki.shibboleth.net/confluence/display/SP3/ReleaseNotes
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
devel: remove 'Created by' lines
A big Thank You to the original contributors of these ports:
* "Waitman Gobble" <uzimac@da3m0n8t3r.com>
* <jkoshy@FreeBSD.org>
* Aaron Dalton <aaron@FreeBSD.org>
* Aaron Dalton <aaron@daltons.ca>
* Aaron H. K. Diep <ahkdiep@gmail.com>
* Aaron Hurt <ahurt@anbcs.com>
* Abel Chow <abel_chow@yahoo.com>
* Adam McLaurin
* Adam Saponara <as@php.net>
* Adam Weinberger <adamw@FreeBSD.org>
* Ade Lovett <ade@FreeBSD.org>
(Only the first 15 lines of the commit message are shown above )
Pull upstreams fix from upcoming release
This fixes a DoS scenario. The commit message from the original commit is
CPPXT - Crash due to uncaught DOMException
Shibboleth SP software vulnerable to additional data forgery flaws
The XML processing performed by the Service Provider software has been
found to be vulnerable to new flaws similar in nature to the one
addressed in an advisory last month.
Security: 22438240-1bd0-11e8-a2ec-6cc21735f730
URL: https://shibboleth.net/community/advisories/secadv_20180227.txt
Update to version 1.6.3
Shibboleth SP software vulnerable to forged user attribute data
====================================================================
The Service Provider software relies on a generic XML parser to process
SAML responses and there are limitations in older versions of the parser
that make it impossible to fully disable Document Type Definition (DTD)
processing.
Through addition/manipulation of a DTD, it's possible to make changes
to an XML document that do not break a digital signature but are
mishandled by the SP and its libraries. These manipulations can alter
the user data passed through to applications behind the SP and result
in impersonation attacks and exposure of protected information.
(Only the first 15 lines of the commit message are shown above )
Update to latest version
This is a fix for a regression in the latest security fix for
security/shibboleth2-sp.
Security: b4b7ec7d-ca27-11e7-a12d-6cc21735f730
Shibboleth SP software crashes on well-formed but invalid XML.
The Service Provider software contains a code path with an uncaught
exception that can be triggered by an unauthenticated attacker by
supplying well-formed but schema-invalid XML in the form of SAML
metadata or SAML protocol messages. The result is a crash and so
causes a denial of service.
You must rebuild opensaml and shibboleth with xmltooling-1.5.5 or later.
The easiest way to do so is to update the whole chain including
shibboleth-2.5.5 an opensaml2.5.5.
URL: http://shibboleth.net/community/advisories/secadv_20150721.txt
Security: CVE-2015-2684
Security update for apache-xml-security-c.
Dependant ports, especially shibboleth2-sp, opensaml2, xmltooling
and log4shib should all be updated.
Security: CVE-2013-2156
Update Shibboleth-sp and its tool chain to 2.5.1.
Note that from 2.5, shibd is run as the user shibd. The port tries to fix the
key file ownership but if you have changed the file name of the key from the
default sp-key.pem, make sure you chown your key file(s) to user shibd.
Also, take maintainership of the entire tool chain (approved by all previous
maintainers).
Incorporates the ideas suggested by Craig Leres [177668], making sure that the
ssl key is not added to the package.
PR: 177668, 178694
Force numerous ports that fail to build with clang over to instead always
rely on gcc. The patch uses the new USE_GCC=any code in Mk/bsd.gcc.mk to
accomplish this.
The ports chosen were ports that blocked 2 or more ports from building with
clang. (There are several hundred other ports that still fail to build with
clang, even with this patch. This is merely one step along the way.)
Those interested in fixing these ports with clang, and have clang as their
default compiler, can simply set FORCE_BASE_CC_FOR_TESTING=yes.
For those who have gcc as their default compiler, this change is believed
to cause no change.
Hat: portmgr
Tested with: multiple runs on amd64-8-exp-bcm and 9-exp-clang, with various
combinations of patch/no-patch and flag settings.
Bump the version of the curl shared library after the ftp/curl update
to 7.19.2.
Bump PORTREVISION, even on the ports that do not have a versioned
dependency, since the binaries will most probably still stop working.
Shibboleth 2.x relies on OpenSAML 2, which in turn requires this
lower-level library that provides a higher level interface to XML
processing, particularly in light of signing and encryption.
WWW: https://spaces.internet2.edu/display/OpenSAML/XMLTooling-C
PR: ports/127326
Submitted by: Janos Mohacsi
