svn commit: r463405 - branches/2018Q1/devel/xmltooling

[Palle Girgensohn]

Author: girgen
Date: Fri Mar  2 14:34:52 2018
New Revision: 463405
URL: https://svnweb.freebsd.org/changeset/ports/463405

Log:
  MFH: r458860 r463146
  
  Update to version 1.6.3
  
  Shibboleth SP software vulnerable to forged user attribute data
  ====================================================================
  The Service Provider software relies on a generic XML parser to process
  SAML responses and there are limitations in older versions of the parser
  that make it impossible to fully disable Document Type Definition (DTD)
  processing.
  
  Through addition/manipulation of a DTD, it's possible to make changes
  to an XML document that do not break a digital signature but are
  mishandled by the SP and its libraries. These manipulations can alter
  the user data passed through to applications behind the SP and result
  in impersonation attacks and exposure of protected information.
  
  While the use of XML Encryption can serve as a mitigation for this bug,
  it may still be possible to construct attacks in such cases, and the SP
  does not provide a means to enforce its use.
  
  An updated version of XMLTooling-C (V1.6.3) is available that works
  around this specific bug.
  
  While newer versions of the parser are configured by the SP into
  disallowing the use of a DTD via an environment variable, this feature
  is not present in the parser used on some supported platforms (notably
  Red Hat and CentOS 7), so an additional fix is being provided now that
  an actual DTD exploit has been identified.
  
  Security:	CVE-2018-0486
  
  Shibboleth SP software vulnerable to additional data forgery flaws
  
  The XML processing performed by the Service Provider software has been
  found to be vulnerable to new flaws similar in nature to the one
  addressed in an advisory last month.
  
  Security:	22438240-1bd0-11e8-a2ec-6cc21735f730
  URL:		https://shibboleth.net/community/advisories/secadv_20180227.txt
  
  Approved by:	ports-secteam

Modified:
  branches/2018Q1/devel/xmltooling/Makefile
  branches/2018Q1/devel/xmltooling/distinfo
  branches/2018Q1/devel/xmltooling/pkg-plist
Directory Properties:
  branches/2018Q1/   (props changed)

Modified: branches/2018Q1/devel/xmltooling/Makefile
==============================================================================
--- branches/2018Q1/devel/xmltooling/Makefile	Fri Mar  2 14:32:37 2018	(r463404)
+++ branches/2018Q1/devel/xmltooling/Makefile	Fri Mar  2 14:34:52 2018	(r463405)
@@ -2,7 +2,7 @@
 # $FreeBSD$
 
 PORTNAME=	xmltooling
-PORTVERSION=	1.6.2
+PORTVERSION=	1.6.4
 CATEGORIES=	devel security
 MASTER_SITES=	http://shibboleth.net/downloads/c++-opensaml/2.6.1/
 

Modified: branches/2018Q1/devel/xmltooling/distinfo
==============================================================================
--- branches/2018Q1/devel/xmltooling/distinfo	Fri Mar  2 14:32:37 2018	(r463404)
+++ branches/2018Q1/devel/xmltooling/distinfo	Fri Mar  2 14:34:52 2018	(r463405)
@@ -1,3 +1,3 @@
-TIMESTAMP = 1510878752
-SHA256 (xmltooling-1.6.2.tar.bz2) = 9fa592b2c000f6775e34c6898a4cc21d0a0b9af3fc26a16cc327a426f9caae3c
-SIZE (xmltooling-1.6.2.tar.bz2) = 580621
+TIMESTAMP = 1519744998
+SHA256 (xmltooling-1.6.4.tar.bz2) = 4c0c4a08b8c55f1210673281f37fc95b6d1d365a8cdc726fd189dea96c45efca
+SIZE (xmltooling-1.6.4.tar.bz2) = 581796

Modified: branches/2018Q1/devel/xmltooling/pkg-plist
==============================================================================
--- branches/2018Q1/devel/xmltooling/pkg-plist	Fri Mar  2 14:32:37 2018	(r463404)
+++ branches/2018Q1/devel/xmltooling/pkg-plist	Fri Mar  2 14:34:52 2018	(r463405)
@@ -83,10 +83,10 @@ include/xmltooling/validation/ValidatorSuite.h
 include/xmltooling/version.h
 lib/libxmltooling-lite.so
 lib/libxmltooling-lite.so.7
-lib/libxmltooling-lite.so.7.0.2
+lib/libxmltooling-lite.so.7.0.4
 lib/libxmltooling.so
 lib/libxmltooling.so.7
-lib/libxmltooling.so.7.0.2
+lib/libxmltooling.so.7.0.4
 libdata/pkgconfig/xmltooling.pc
 share/xml/xmltooling/catalog.xml
 share/xml/xmltooling/soap-envelope.xsd