net-mgmt/py-napalm-logs: Update to 0.11.0
0.9.0 fails on Python 3.12+: napalm_logs.base imports imp (removed
in 3.12) to load the Python device profiles, and it calls yaml.load()
without a Loader, which PyYAML 6 rejects, so no YAML profile loads.
0.11.0 fixes the YAML loading.
Also add some patches to fix the following issues:
* Replace the imp calls with importlib.
* napalm_logs/__init__.py imports pkg_resources to look up its
version; pkg_resources is deprecated and only available with
setuptools, which is not a run dependency. Use importlib.metadata.
* The authenticator process and the ClientAuth helper call
ssl.wrap_socket(), removed in Python 3.12, so the auth process
crashes on the first connection and clients cannot authenticate.
Use SSLContext with the same behaviour.
[11 lines not shown]
Revert "snd_hda: Identify AMD Audio Coprocessor"
Apparently this device might need a separate driver altogether.
This reverts commit 8dac0bdb4df0815e14db219e9a7fb5d0be5737b8.
www/freenginx: Security update to 1.30.2
One of the keys was left uninitialized when using automatic rotation of
TLS session ticket keys, which makes it possible to forge a session and
bypass client certificate verification.
Changes: https://freenginx.org/en/CHANGES-1.30
Security: 4784aba5-d6a9-11f1-8a93-a0369f6e85b8
Sponsored by: Netzkommune GmbH
(cherry picked from commit 7ac2e3d6e973bcef7bf45b72656a71e253cd9c75)
www/phpbb3: Security update to 3.3.19
Fixes an unauthenticated SMTP command injection through the contact
form, reflected and stored cross-site scripting, a missing CSRF check
when held private messages are released and several moderator permission
bypasses.
The same fixes were announced for 3.3.18, whose downloads did not carry
them.
Changelog:
https://github.com/phpbb/phpbb/blob/release-3.3.19/phpBB/docs/CHANGELOG.html
Security: 4784d4b8-d6a9-11f1-8a93-a0369f6e85b8
Sponsored by: Netzkommune GmbH
(cherry picked from commit 4d6d2c1680a007e107e49cc4fa9042781a677a61)
security/gssproxy: Update to 0.9.3
Collects the fixes made upstream since the last release, among them a
use-after-free in gp_count_tickets(), a leaked remote context in
gpp_remote_to_local_ctx(), a dynamic keytab loader and support for
clients running in an AT_SECURE context.
Changelog: https://github.com/gssapi/gssproxy/releases/tag/v0.9.3
Sponsored by: Netzkommune GmbH
mail/davmail: Update to 7.1.0
Graph fixes around calendar transaction ids and recurrence time zones,
native people search for the global address list, room booking over EWS
and CalDAV, UID EXPUNGE and UNKEYWORD for IMAP, and a new -generateCert
option that writes a self-signed PKCS12 certificate.
Changelog:
https://sourceforge.net/p/davmail/code/HEAD/tree/tags/7.1.0/RELEASE-NOTES.md
Sponsored by: Netzkommune GmbH
www/freenginx: Security update to 1.30.2
One of the keys was left uninitialized when using automatic rotation of
TLS session ticket keys, which makes it possible to forge a session and
bypass client certificate verification.
Changes: https://freenginx.org/en/CHANGES-1.30
Security: 4784aba5-d6a9-11f1-8a93-a0369f6e85b8
Sponsored by: Netzkommune GmbH
ix(4): Support Total Port Shutdown on E610
Firmware controls the physical link state on E610 adapters, similarly to
X700 and E800 adapters. As a result, running "ifconfig down" does not
disable the physical link unless Total Port Shutdown is enabled.
Read the Link Default Override TLV from NVM to detect when Total
Port Shutdown was enabled for given port in system setup. In that
case, force the link down when the interface is stopped and restore
it during link configuration. Leave link state management unchanged
when the TLV is unavailable or the feature is not enabled.
Co-authored-by: Miłosz Linkiewicz <milosz.linkiewicz at intel.com>
Co-authored-by: Tomasz Lichwala <tomasz.lichwala at intel.com>
Signed-off-by: Krzysztof Galazka <krzysztof.galazka at intel.com>
Tested by: Mateusz Moga <mateusz.moga at intel.com>
MFC after: 1 week
Sponsored by: Intel Corporation
Differential Revision: https://reviews.freebsd.org/D60643
www/phpbb3: Security update to 3.3.19
Fixes an unauthenticated SMTP command injection through the contact
form, reflected and stored cross-site scripting, a missing CSRF check
when held private messages are released and several moderator permission
bypasses.
The same fixes were announced for 3.3.18, whose downloads did not carry
them.
Changelog:
https://github.com/phpbb/phpbb/blob/release-3.3.19/phpBB/docs/CHANGELOG.html
Security: 4784d4b8-d6a9-11f1-8a93-a0369f6e85b8
Sponsored by: Netzkommune GmbH
