notbugAs an Amazon Associate I earn from qualifying purchases.
Want a good read? Try FreeBSD Mastery: Jails (IT Mastery Book 15)
Ukraine
Some details on the 2023-01-16 website outage.
We just rebooted with several updates: * new HMTLify code * no port maintainer is now highly visible (e.g. https://freshports.org/security/sssd/) * fixed search logic error when using plain/ text details at https://github.com/FreshPorts/freshports/releases/tag/2.2.34
non port: security/shibboleth2-sp/distinfo
SVNWeb

Number of commits found: 12

Wed, 15 Nov 2017
[ 17:21 girgen search for other commits by this committer ] Original commit   Revision:454256
Shibboleth Service Provider Security Advisory [15 November 2017]

An updated version of the Shibboleth Service Provider software
is available which corrects a critical security issue in the
"Dynamic" metadata provider plugin.

Deployers making use of the affected feature should apply the
relevant update at the soonest possible moment.

Security:	b4b7ec7d-ca27-11e7-a12d-6cc21735f730
Sun, 11 Sep 2016
[ 21:52 girgen search for other commits by this committer ] Original commit   Revision:421878 (Only the first 10 of 12 ports in this commit are shown above. View all ports for this commit)
Upgrade shibboleth-sp 2.6 and its tool chain
Sun, 28 Feb 2016
[ 18:55 girgen search for other commits by this committer ] Original commit   Revision:409756
Update xerces-c3 and shibboleth to latest versions

The update in xerces fixes a buffer overflow security problem that exposes the
possibility of a denial of service attack, and could conceivably result in
remote code execution.

Users of Shibboleth or any other service usingi the xerces-c3 xml library are
recommended to upgrade promptly.

URL:	http://xerces.apache.org/xerces-c/secadv/CVE-2016-0729.txt
Security:	CVE-2016-0729
Thu, 23 Jul 2015
[ 13:21 girgen search for other commits by this committer ] Original commit   Revision:392720 (Only the first 10 of 12 ports in this commit are shown above. View all ports for this commit)
Shibboleth SP software crashes on well-formed but invalid XML.

The Service Provider software contains a code path with an uncaught
exception that can be triggered by an unauthenticated attacker by
supplying well-formed but schema-invalid XML in the form of SAML
metadata or SAML protocol messages. The result is a crash and so
causes a denial of service.

You must rebuild opensaml and shibboleth with xmltooling-1.5.5 or later.
The easiest way to do so is to update the whole chain including
shibboleth-2.5.5 an opensaml2.5.5.

URL:    	http://shibboleth.net/community/advisories/secadv_20150721.txt
Security:	CVE-2015-2684
Fri, 22 May 2015
[ 22:24 girgen search for other commits by this committer ] Original commit   Revision:387087
Update Shibboleth and opensaml to latest version.
Thu, 8 May 2014
[ 01:35 girgen search for other commits by this committer ] Original commit   Revision:353234
Update Shibboleth to 2.5.3, a bug fix release.

Change the cache directory back to the built-in default, /var/cache, and
force mode 755 on that directory. (see r258664 in head why this is a good
thing).

Add odbc support as suggested in ports/189410.
Tue, 18 Jun 2013
[ 15:15 girgen search for other commits by this committer ] Original commit   Revision:321194
Security update for apache-xml-security-c.
Dependant ports, especially shibboleth2-sp, opensaml2, xmltooling
and log4shib should all be updated.

Security: CVE-2013-2156
Tue, 4 Jun 2013
[ 17:29 girgen search for other commits by this committer ] Original commit   Revision:319885 (Only the first 10 of 21 ports in this commit are shown above. View all ports for this commit)
Update Shibboleth-sp and its tool chain to 2.5.1.

Note that from 2.5, shibd is run as the user shibd.  The port tries to fix the
key file ownership but if you have changed the file name of the key from the
default sp-key.pem, make sure you chown your key file(s) to user shibd.

Also, take maintainership of the entire tool chain (approved by all previous
maintainers).

Incorporates the ideas suggested by Craig Leres [177668], making sure that the
ssl key is not added to the package.

PR:	177668, 178694
Thu, 28 Jul 2011
[ 11:55 swills search for other commits by this committer ] Original commit 
- Update to 2.4.3
- Update home page while here
- Take maintainership while here

PR:             ports/159195
Approved by:    linimon
Mon, 27 Jun 2011
[ 02:57 swills search for other commits by this committer ] Original commit  (Only the first 10 of 13 ports in this commit are shown above. View all ports for this commit)
- Update to latest versions

PR:             ports/157822
Submited by:    Palle Girgensohn <girgen@FreeBSD.org>
Approved by:    maintainer timeout
Tue, 26 Jan 2010
[ 02:35 wxs search for other commits by this committer ] Original commit 
- Update to 2.3.1.

PR:             ports/136034
Submitted by:   Steve Wills <steve@mouf.net>
Approved by:    janos.mohacsi@bsd.hu (maintainer timeout)
Tue, 21 Jul 2009
[ 03:58 pgollucci search for other commits by this committer ] Original commit 
- forced commit to note repo copy

  security/shibboleth-sp -> security/shibboleth2-sp

Repocopy by:    marcus

Number of commits found: 12