www/freenginx: Security update to 1.30.2
One of the keys was left uninitialized when using automatic rotation of
TLS session ticket keys, which makes it possible to forge a session and
bypass client certificate verification.
Changes: https://freenginx.org/en/CHANGES-1.30
Security: 4784aba5-d6a9-11f1-8a93-a0369f6e85b8
Sponsored by: Netzkommune GmbH
(cherry picked from commit 7ac2e3d6e973bcef7bf45b72656a71e253cd9c75)
www/phpbb3: Security update to 3.3.19
Fixes an unauthenticated SMTP command injection through the contact
form, reflected and stored cross-site scripting, a missing CSRF check
when held private messages are released and several moderator permission
bypasses.
The same fixes were announced for 3.3.18, whose downloads did not carry
them.
Changelog:
https://github.com/phpbb/phpbb/blob/release-3.3.19/phpBB/docs/CHANGELOG.html
Security: 4784d4b8-d6a9-11f1-8a93-a0369f6e85b8
Sponsored by: Netzkommune GmbH
(cherry picked from commit 4d6d2c1680a007e107e49cc4fa9042781a677a61)
security/gssproxy: Update to 0.9.3
Collects the fixes made upstream since the last release, among them a
use-after-free in gp_count_tickets(), a leaked remote context in
gpp_remote_to_local_ctx(), a dynamic keytab loader and support for
clients running in an AT_SECURE context.
Changelog: https://github.com/gssapi/gssproxy/releases/tag/v0.9.3
Sponsored by: Netzkommune GmbH
mail/davmail: Update to 7.1.0
Graph fixes around calendar transaction ids and recurrence time zones,
native people search for the global address list, room booking over EWS
and CalDAV, UID EXPUNGE and UNKEYWORD for IMAP, and a new -generateCert
option that writes a self-signed PKCS12 certificate.
Changelog:
https://sourceforge.net/p/davmail/code/HEAD/tree/tags/7.1.0/RELEASE-NOTES.md
Sponsored by: Netzkommune GmbH
www/freenginx: Security update to 1.30.2
One of the keys was left uninitialized when using automatic rotation of
TLS session ticket keys, which makes it possible to forge a session and
bypass client certificate verification.
Changes: https://freenginx.org/en/CHANGES-1.30
Security: 4784aba5-d6a9-11f1-8a93-a0369f6e85b8
Sponsored by: Netzkommune GmbH
www/phpbb3: Security update to 3.3.19
Fixes an unauthenticated SMTP command injection through the contact
form, reflected and stored cross-site scripting, a missing CSRF check
when held private messages are released and several moderator permission
bypasses.
The same fixes were announced for 3.3.18, whose downloads did not carry
them.
Changelog:
https://github.com/phpbb/phpbb/blob/release-3.3.19/phpBB/docs/CHANGELOG.html
Security: 4784d4b8-d6a9-11f1-8a93-a0369f6e85b8
Sponsored by: Netzkommune GmbH
www/redmine70: update to 7.0.3
Security and bug fix release: fixes a ReDoS in wiki macro argument
parsing, a reflected XSS and open redirect via back_url, and OAuth
token scope bypasses.
