notbugAs an Amazon Associate I earn from qualifying purchases.
Want a good read? Try FreeBSD Mastery: Jails (IT Mastery Book 15)
Ukraine
NOTE: There is a known problem on production with searching pkg-plist - it returns no results. This problem is not present on stage.freshports.org
non port: devel/xmltooling/distinfo
SVNWeb

Number of commits found: 19

Mon, 7 Nov 2022
[ 17:03 Palle Girgensohn (girgen) search for other commits by this committer ]    commit hash:b4e7dc9bf4a25f8fb4858b55d811f2b001a49602  commit hash:b4e7dc9bf4a25f8fb4858b55d811f2b001a49602  commit hash:b4e7dc9bf4a25f8fb4858b55d811f2b001a49602  b4e7dc9  (Only the first 10 of 11 ports in this commit are shown above. View all ports for this commit)
security/shibboleth-sp: update to 3.4.0

This is a minor update containing a new setting suggested by a
contributor (thus the unplanned minor version change) controlling
retries when TCP connections to shibd are used. The other changes are
minimal in nature.

Update the toolchain as well:

devel/xmltooling
textproc/xerces-c3

and bump PORTREVISION for security/opensaml due to dependencies'
updates.

Release notes:	https://wiki.shibboleth.net/confluence/display/SP3/ReleaseNotes
Tue, 30 Nov 2021
[ 14:42 Palle Girgensohn (girgen) search for other commits by this committer ]    commit hash:8de027017663e95f66026d5e42c4e9472443538a  commit hash:8de027017663e95f66026d5e42c4e9472443538a  commit hash:8de027017663e95f66026d5e42c4e9472443538a  8de0270 
devel/xmltooling: update to 3.2.1
Fri, 18 Dec 2020
[ 08:51 girgen search for other commits by this committer ] Original commit   Revision:558359
Update xmltooling to 3.2.0

Bump dependant ports. xmltooling is only used as a dependency for
security/shibboleth-sp.

Release notes:	https://wiki.shibboleth.net/confluence/display/SP3/ReleaseNotes
Mon, 13 Apr 2020
[ 22:15 girgen search for other commits by this committer ] Original commit   Revision:531638
The Shibboleth Project has released V3.1.0 of the Service Provider software.

Release notes:	https://wiki.shibboleth.net/confluence/display/SP3/ReleaseNotes
Mon, 11 Mar 2019
[ 17:02 girgen search for other commits by this committer ] Original commit   Revision:495367
Update Shibboleth and its tool chain to 3.0.4

The security problem was patched alreadyin 3.0.3p1, but all users are
recommended to update to the latest version at next service window.

Security:	CVE-2019-9628
		https://shibboleth.net/community/advisories/secadv_20190311.txt
Release notes:	https://wiki.shibboleth.net/confluence/display/SP3/ReleaseNotes
Sun, 23 Dec 2018
[ 10:54 girgen search for other commits by this committer ] Original commit   Revision:488188
Update to version 3.0.3

The update corrects a denial of service vulnerability.

Security:	4f8665d0-0465-11e9-b77a-6cc21735f730
Tue, 7 Aug 2018
[ 13:24 girgen search for other commits by this committer ] Original commit   Revision:476595 (Only the first 10 of 32 ports in this commit are shown above. View all ports for this commit)
Update Shibboleth to 3.0.2

Also update the toolchain to latest versions. This includes a security fix for
apache-xml-security-c.

Releaseinfo:    https://wiki.shibboleth.net/confluence/display/SP3/ReleaseNotes
Security:       5786185a-9a43-11e8-b34b-6cc21735f730
Security:       https://shibboleth.net/community/advisories/secadv_20180803.txt
Tue, 27 Feb 2018
[ 15:37 girgen search for other commits by this committer ] Original commit   Revision:463146
Shibboleth SP software vulnerable to additional data forgery flaws

The XML processing performed by the Service Provider software has been
found to be vulnerable to new flaws similar in nature to the one
addressed in an advisory last month.

Security:	22438240-1bd0-11e8-a2ec-6cc21735f730
URL:		https://shibboleth.net/community/advisories/secadv_20180227.txt
Fri, 12 Jan 2018
[ 17:39 girgen search for other commits by this committer ] Original commit   Revision:458860
Update to version 1.6.3

Shibboleth SP software vulnerable to forged user attribute data
====================================================================
The Service Provider software relies on a generic XML parser to process
SAML responses and there are limitations in older versions of the parser
that make it impossible to fully disable Document Type Definition (DTD)
processing.

Through addition/manipulation of a DTD, it's possible to make changes
to an XML document that do not break a digital signature but are
mishandled by the SP and its libraries. These manipulations can alter
the user data passed through to applications behind the SP and result
in impersonation attacks and exposure of protected information.
(Only the first 15 lines of the commit message are shown above View all of this commit message)
Fri, 17 Nov 2017
[ 10:37 girgen search for other commits by this committer ] Original commit   Revision:454371
Update to latest version

This is a fix for a regression in the latest security fix for
security/shibboleth2-sp.

Security:	b4b7ec7d-ca27-11e7-a12d-6cc21735f730
Sun, 11 Sep 2016
[ 21:52 girgen search for other commits by this committer ] Original commit   Revision:421878 (Only the first 10 of 12 ports in this commit are shown above. View all ports for this commit)
Upgrade shibboleth-sp 2.6 and its tool chain
Thu, 23 Jul 2015
[ 13:21 girgen search for other commits by this committer ] Original commit   Revision:392720 (Only the first 10 of 12 ports in this commit are shown above. View all ports for this commit)
Shibboleth SP software crashes on well-formed but invalid XML.

The Service Provider software contains a code path with an uncaught
exception that can be triggered by an unauthenticated attacker by
supplying well-formed but schema-invalid XML in the form of SAML
metadata or SAML protocol messages. The result is a crash and so
causes a denial of service.

You must rebuild opensaml and shibboleth with xmltooling-1.5.5 or later.
The easiest way to do so is to update the whole chain including
shibboleth-2.5.5 an opensaml2.5.5.

URL:    	http://shibboleth.net/community/advisories/secadv_20150721.txt
Security:	CVE-2015-2684
Tue, 18 Jun 2013
[ 15:15 girgen search for other commits by this committer ] Original commit   Revision:321194
Security update for apache-xml-security-c.
Dependant ports, especially shibboleth2-sp, opensaml2, xmltooling
and log4shib should all be updated.

Security: CVE-2013-2156
Tue, 4 Jun 2013
[ 17:29 girgen search for other commits by this committer ] Original commit   Revision:319885 (Only the first 10 of 21 ports in this commit are shown above. View all ports for this commit)
Update Shibboleth-sp and its tool chain to 2.5.1.

Note that from 2.5, shibd is run as the user shibd.  The port tries to fix the
key file ownership but if you have changed the file name of the key from the
default sp-key.pem, make sure you chown your key file(s) to user shibd.

Also, take maintainership of the entire tool chain (approved by all previous
maintainers).

Incorporates the ideas suggested by Craig Leres [177668], making sure that the
ssl key is not added to the package.

PR:	177668, 178694
Thu, 28 Jul 2011
[ 11:53 swills search for other commits by this committer ] Original commit 
- Update to 1.4.2
- Update home page while here
- Take maintainership

PR:             ports/159195
Approved by:    linimon
Mon, 27 Jun 2011
[ 02:57 swills search for other commits by this committer ] Original commit  (Only the first 10 of 13 ports in this commit are shown above. View all ports for this commit)
- Update to latest versions

PR:             ports/157822
Submited by:    Palle Girgensohn <girgen@FreeBSD.org>
Approved by:    maintainer timeout
Fri, 8 Jan 2010
[ 01:24 pgollucci search for other commits by this committer ] Original commit 
- Update to 2.3

PR:             ports/142324
Submitted by:   Steve Wills <steve@mouf.net>
Approved by:    Mohacsi Janos <janos.mohacsi@bsd.hu> (maintainer)
Fri, 10 Jul 2009
[ 01:15 wxs search for other commits by this committer ] Original commit 
- Update to 1.2

PR:             ports/136033
Submitted by:   Steve Wills <steve@mouf.net>
Approved by:    maintainer
Sat, 22 Nov 2008
[ 15:15 miwi search for other commits by this committer ] Original commit 
Shibboleth 2.x relies on OpenSAML 2, which in turn requires this
lower-level library that provides a higher level interface to XML
processing, particularly in light of signing and encryption.

WWW: https://spaces.internet2.edu/display/OpenSAML/XMLTooling-C

PR:             ports/127326
Submitted by:   Janos Mohacsi

Number of commits found: 19