aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--UPDATING11
-rw-r--r--databases/postgresql83-server/Makefile2
-rw-r--r--databases/postgresql83-server/files/patch-crypt-des.c12
-rw-r--r--databases/postgresql84-server/Makefile1
-rw-r--r--databases/postgresql84-server/files/patch-crypt-des.c12
-rw-r--r--databases/postgresql90-server/Makefile2
-rw-r--r--databases/postgresql90-server/files/patch-crypt-des.c12
-rw-r--r--databases/postgresql91-server/Makefile1
-rw-r--r--databases/postgresql91-server/files/patch-crypt-des.c12
-rw-r--r--databases/postgresql92-server/Makefile1
-rw-r--r--databases/postgresql92-server/files/patch-crypt-des.c12
-rw-r--r--security/vuxml/vuln.xml36
12 files changed, 112 insertions, 2 deletions
diff --git a/UPDATING b/UPDATING
index c2de183bccc6..1941a77fc761 100644
--- a/UPDATING
+++ b/UPDATING
@@ -6,6 +6,17 @@ You should get into the habit of checking this file for changes each time
you update your ports collection, before attempting any port upgrades.
20120530:
+ AFFECTS: users of databases/postgresql*-server
+ AUTHOR: jgh@FreeBSD.org
+
+ Affected users are those who use the crypt(text, text) function with
+ DES encryption in the optional pg_crypto module. Passwords affected
+ are those that contain characters that cannot be represented with
+ 7-bit ASCII. If a password contains a character that has the most
+ significant bit set (0x80), and DES encryption is used, that character
+ and all characters after it will be ignored.
+
+20120530:
AFFECTS: users of net/nss-pam-ldap
AUTHOR: scheidell@FreeBSD.org
diff --git a/databases/postgresql83-server/Makefile b/databases/postgresql83-server/Makefile
index f93de7faac03..6a3dca1ccb8a 100644
--- a/databases/postgresql83-server/Makefile
+++ b/databases/postgresql83-server/Makefile
@@ -6,7 +6,7 @@
#
DISTVERSION?= 8.3.18
-PORTREVISION?= 0
+PORTREVISION?= 1
PKGNAMESUFFIX?= -server
MAINTAINER?= pgsql@FreeBSD.org
diff --git a/databases/postgresql83-server/files/patch-crypt-des.c b/databases/postgresql83-server/files/patch-crypt-des.c
new file mode 100644
index 000000000000..ce61aaa5b2b7
--- /dev/null
+++ b/databases/postgresql83-server/files/patch-crypt-des.c
@@ -0,0 +1,12 @@
+--- ./contrib/pgcrypto/crypt-des.c
++++ ./contrib/pgcrypto/crypt-des.c
+@@ -670,7 +670,8 @@ px_crypt_des(const char *key, const char *setting)
+ q = (uint8 *) keybuf;
+ while (q - (uint8 *) keybuf - 8)
+ {
+- if ((*q++ = *key << 1))
++ *q++ = *key << 1;
++ if (*key != '\0')
+ key++;
+ }
+ if (des_setkey((char *) keybuf))
diff --git a/databases/postgresql84-server/Makefile b/databases/postgresql84-server/Makefile
index 6804988d6d41..5ac8cd1de70c 100644
--- a/databases/postgresql84-server/Makefile
+++ b/databases/postgresql84-server/Makefile
@@ -7,6 +7,7 @@
PORTNAME?= postgresql
DISTVERSION?= 8.4.11
+PORTREVISION?= 1
CATEGORIES?= databases
MASTER_SITES= ${MASTER_SITE_PGSQL}
MASTER_SITE_SUBDIR= source/v${DISTVERSION}
diff --git a/databases/postgresql84-server/files/patch-crypt-des.c b/databases/postgresql84-server/files/patch-crypt-des.c
new file mode 100644
index 000000000000..ce61aaa5b2b7
--- /dev/null
+++ b/databases/postgresql84-server/files/patch-crypt-des.c
@@ -0,0 +1,12 @@
+--- ./contrib/pgcrypto/crypt-des.c
++++ ./contrib/pgcrypto/crypt-des.c
+@@ -670,7 +670,8 @@ px_crypt_des(const char *key, const char *setting)
+ q = (uint8 *) keybuf;
+ while (q - (uint8 *) keybuf - 8)
+ {
+- if ((*q++ = *key << 1))
++ *q++ = *key << 1;
++ if (*key != '\0')
+ key++;
+ }
+ if (des_setkey((char *) keybuf))
diff --git a/databases/postgresql90-server/Makefile b/databases/postgresql90-server/Makefile
index 814b8a329554..1987b2981c66 100644
--- a/databases/postgresql90-server/Makefile
+++ b/databases/postgresql90-server/Makefile
@@ -6,7 +6,7 @@
#
DISTVERSION?= 9.0.7
-PORTREVISION= 1
+PORTREVISION= 2
PKGNAMESUFFIX?= -server
MAINTAINER?= pgsql@FreeBSD.org
diff --git a/databases/postgresql90-server/files/patch-crypt-des.c b/databases/postgresql90-server/files/patch-crypt-des.c
new file mode 100644
index 000000000000..ce61aaa5b2b7
--- /dev/null
+++ b/databases/postgresql90-server/files/patch-crypt-des.c
@@ -0,0 +1,12 @@
+--- ./contrib/pgcrypto/crypt-des.c
++++ ./contrib/pgcrypto/crypt-des.c
+@@ -670,7 +670,8 @@ px_crypt_des(const char *key, const char *setting)
+ q = (uint8 *) keybuf;
+ while (q - (uint8 *) keybuf - 8)
+ {
+- if ((*q++ = *key << 1))
++ *q++ = *key << 1;
++ if (*key != '\0')
+ key++;
+ }
+ if (des_setkey((char *) keybuf))
diff --git a/databases/postgresql91-server/Makefile b/databases/postgresql91-server/Makefile
index 1926a6033ab0..a68ad29b9926 100644
--- a/databases/postgresql91-server/Makefile
+++ b/databases/postgresql91-server/Makefile
@@ -7,6 +7,7 @@
PORTNAME?= postgresql
DISTVERSION?= 9.1.3
+PORTREVISION?= 1
CATEGORIES?= databases
MASTER_SITES= ${MASTER_SITE_PGSQL}
MASTER_SITE_SUBDIR= source/v${DISTVERSION}
diff --git a/databases/postgresql91-server/files/patch-crypt-des.c b/databases/postgresql91-server/files/patch-crypt-des.c
new file mode 100644
index 000000000000..ce61aaa5b2b7
--- /dev/null
+++ b/databases/postgresql91-server/files/patch-crypt-des.c
@@ -0,0 +1,12 @@
+--- ./contrib/pgcrypto/crypt-des.c
++++ ./contrib/pgcrypto/crypt-des.c
+@@ -670,7 +670,8 @@ px_crypt_des(const char *key, const char *setting)
+ q = (uint8 *) keybuf;
+ while (q - (uint8 *) keybuf - 8)
+ {
+- if ((*q++ = *key << 1))
++ *q++ = *key << 1;
++ if (*key != '\0')
+ key++;
+ }
+ if (des_setkey((char *) keybuf))
diff --git a/databases/postgresql92-server/Makefile b/databases/postgresql92-server/Makefile
index ff6f70c71820..1ded113142f3 100644
--- a/databases/postgresql92-server/Makefile
+++ b/databases/postgresql92-server/Makefile
@@ -7,6 +7,7 @@
PORTNAME?= postgresql
DISTVERSION?= 9.2beta1
+PORTREVISION?= 1
CATEGORIES?= databases
MASTER_SITES= ${MASTER_SITE_PGSQL}
MASTER_SITE_SUBDIR= source/v9.2.0beta1
diff --git a/databases/postgresql92-server/files/patch-crypt-des.c b/databases/postgresql92-server/files/patch-crypt-des.c
new file mode 100644
index 000000000000..ce61aaa5b2b7
--- /dev/null
+++ b/databases/postgresql92-server/files/patch-crypt-des.c
@@ -0,0 +1,12 @@
+--- ./contrib/pgcrypto/crypt-des.c
++++ ./contrib/pgcrypto/crypt-des.c
+@@ -670,7 +670,8 @@ px_crypt_des(const char *key, const char *setting)
+ q = (uint8 *) keybuf;
+ while (q - (uint8 *) keybuf - 8)
+ {
+- if ((*q++ = *key << 1))
++ *q++ = *key << 1;
++ if (*key != '\0')
+ key++;
+ }
+ if (des_setkey((char *) keybuf))
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml
index 3897d16b9c17..4f447d426e72 100644
--- a/security/vuxml/vuln.xml
+++ b/security/vuxml/vuln.xml
@@ -52,6 +52,42 @@ Note: Please add new entries to the beginning of this file.
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="a8864f8f-aa9e-11e1-a284-0023ae8e59f0">
+ <topic>databases/postgresql*-server -- crypt vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>postgresql-server</name>
+ <range><lt>8.3.18_1</lt></range>
+ <range><lt>8.4.11_1</lt></range>
+ <range><lt>9.0.7_2</lt></range>
+ <range><lt>9.1.3_1</lt></range>
+ <range><lt>9.2.b1_1</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>The PostgreSQL Global Development Group reports:</p>
+ <blockquote cite="http://www.postgresql.org/about/news/1397/">
+ <p>Affected users are those who use the crypt(text, text) function
+ with DES encryption in the optional pg_crypto module. Passwords
+ affected are those that contain characters that cannot be
+ represented with 7-bit ASCII. If a password contains a character
+ that has the most significant bit set (0x80), and DES encryption
+ is used, that character and all characters after it will be ignored.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2012-2143</cvename>
+ <url>http://www.postgresql.org/about/news/1397/</url>
+ <url>http://git.postgresql.org/gitweb/?p=postgresql.git;a=patch;h=932ded2ed51e8333852e370c7a6dad75d9f236f9</url>
+ </references>
+ <dates>
+ <discovery>2012-05-30</discovery>
+ <entry>2012-05-30</entry>
+ </dates>
+ </vuln>
+
<vuln vid="47f13540-c4cb-4971-8dc6-28d0dabfd9cd">
<topic>nut -- upsd can be remotely crashed</topic>
<affects>
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-30 02:38:57 +0000