CVS commit: pkgsrc/security

["Niclas Rosenvik" <nros%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   nros
Date:           Thu Nov  5 11:11:15 UTC 2026

Modified Files:
        pkgsrc/security/botan3: Makefile Makefile.common PLIST buildlink3.mk
            distinfo
        pkgsrc/security/botan3/patches: patch-src_scripts_install.py
        pkgsrc/security/py-botan3: Makefile

Log Message:
Update botan3 to version 3.14.0

CVE fixes from changelog since version 3.9.0:

CVE-2026-118770 Fix a use after
free in the TLS asio integration which depending on application
usage patterns may allow leaking heap memory to the peer.

CVE-2026-118771 Fix a bug in TLS 1.3 which could allow an
unauthenticated peer to pin unlimited amounts of memory in the
handshake by sending many dummy ChangeCipherSpec messages.

CVE-2026-118766 Fix a blind SSRF during OCSP request processing.
A malicious OCSP responder or network attacker could cause the
application to perform a blind GET to an internal service.

CVE-2026-118765 Fix a bug in AutoSeeded_RNG, affecting only platforms
without a system RNG, where an API sequence of calling first clear,
followed by randomize writing to an empty buffer, resulted in the RNG
object being considered seeded even though it was not.

CVE-2026-104267 Fix an integer overflow in Scrypt parameter handling,
affecting 32-bit platforms.

CVE-2026-48057 Fix a bug where certain DN name constraints were not
correctly enforced.

CVE-2026-118769 Fix an integer overflow in the FFI interface which
might be exploitable in unusual scenarios involving attacker-control
cipher specifiers and the raw block cipher (ECB) APIs.

CVE-2026-44378: Resolve a CPU based denial of service when decoding
BER encoded data.

CVE-2026-34582: Resolve TLS 1.3 client authentication bypass

CVE-2026-32877: Fix a heap over-read during SM2 decryption

CVE-2026-32883: Fix an OCSP response forgery vulnerability

CVE-2026-32884: Fix a name constraints bypass for DNS names


To generate a diff of this commit:
cvs rdiff -u -r1.25 -r1.26 pkgsrc/security/botan3/Makefile
cvs rdiff -u -r1.7 -r1.8 pkgsrc/security/botan3/Makefile.common \
    pkgsrc/security/botan3/PLIST
cvs rdiff -u -r1.12 -r1.13 pkgsrc/security/botan3/buildlink3.mk
cvs rdiff -u -r1.9 -r1.10 pkgsrc/security/botan3/distinfo
cvs rdiff -u -r1.1 -r1.2 \
    pkgsrc/security/botan3/patches/patch-src_scripts_install.py
cvs rdiff -u -r1.10 -r1.11 pkgsrc/security/py-botan3/Makefile

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/botan3/Makefile
diff -u pkgsrc/security/botan3/Makefile:1.25 pkgsrc/security/botan3/Makefile:1.26
--- pkgsrc/security/botan3/Makefile:1.25        Mon Nov  2 15:10:52 2026
+++ pkgsrc/security/botan3/Makefile     Thu Nov  5 11:11:14 2026
@@ -1,6 +1,5 @@
-# $NetBSD: Makefile,v 1.25 2026/11/02 15:10:52 nros Exp $
+# $NetBSD: Makefile,v 1.26 2026/11/05 11:11:14 nros Exp $
 
-PKGREVISION= 3
 .include "Makefile.common"
 
 PKGNAME=       ${DISTNAME:S/Botan/botan3/}

Index: pkgsrc/security/botan3/Makefile.common
diff -u pkgsrc/security/botan3/Makefile.common:1.7 pkgsrc/security/botan3/Makefile.common:1.8
--- pkgsrc/security/botan3/Makefile.common:1.7  Sun Oct 19 13:45:30 2025
+++ pkgsrc/security/botan3/Makefile.common      Thu Nov  5 11:11:14 2026
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile.common,v 1.7 2025/10/19 13:45:30 adam Exp $
+# $NetBSD: Makefile.common,v 1.8 2026/11/05 11:11:14 nros Exp $
 #
 # used by security/py-botan3/Makefile
 
-DISTNAME=      Botan-3.9.0
+DISTNAME=      Botan-3.14.0
 CATEGORIES=    security
 MASTER_SITES=  https://botan.randombit.net/releases/
 EXTRACT_SUFX=  .tar.xz
Index: pkgsrc/security/botan3/PLIST
diff -u pkgsrc/security/botan3/PLIST:1.7 pkgsrc/security/botan3/PLIST:1.8
--- pkgsrc/security/botan3/PLIST:1.7    Sun Oct 19 13:45:30 2025
+++ pkgsrc/security/botan3/PLIST        Thu Nov  5 11:11:14 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.7 2025/10/19 13:45:30 adam Exp $
+@comment $NetBSD: PLIST,v 1.8 2026/11/05 11:11:14 nros Exp $
 bin/botan3
 include/botan-3/botan/aead.h
 include/botan-3/botan/allocator.h
@@ -12,6 +12,7 @@ include/botan-3/botan/asio_error.h
 include/botan-3/botan/asio_stream.h
 include/botan-3/botan/asn1_obj.h
 include/botan-3/botan/asn1_print.h
+include/botan-3/botan/asn1_time.h
 include/botan-3/botan/assert.h
 include/botan-3/botan/auto_rng.h
 include/botan-3/botan/base32.h
@@ -22,6 +23,7 @@ include/botan-3/botan/bcrypt_pbkdf.h
 include/botan-3/botan/ber_dec.h
 include/botan-3/botan/bigint.h
 include/botan-3/botan/block_cipher.h
+include/botan-3/botan/bls12_381.h
 include/botan-3/botan/buf_comp.h
 include/botan-3/botan/build.h
 include/botan-3/botan/bzip2.h
@@ -49,6 +51,7 @@ include/botan-3/botan/dh.h
 include/botan-3/botan/dilithium.h
 include/botan-3/botan/dl_group.h
 include/botan-3/botan/dlies.h
+include/botan-3/botan/dns_name.h
 include/botan-3/botan/dsa.h
 include/botan-3/botan/ec_apoint.h
 include/botan-3/botan/ec_group.h
@@ -64,6 +67,7 @@ include/botan-3/botan/eckcdsa.h
 include/botan-3/botan/ed25519.h
 include/botan-3/botan/ed448.h
 include/botan-3/botan/elgamal.h
+include/botan-3/botan/email.h
 include/botan-3/botan/entropy_src.h
 include/botan-3/botan/exceptn.h
 include/botan-3/botan/fd_unix.h
@@ -77,7 +81,10 @@ include/botan-3/botan/gost_3410.h
 include/botan-3/botan/hash.h
 include/botan-3/botan/hex.h
 include/botan-3/botan/hmac_drbg.h
+include/botan-3/botan/hpke.h
 include/botan-3/botan/hss_lms.h
+include/botan-3/botan/ipv4_address.h
+include/botan-3/botan/ipv6_address.h
 include/botan-3/botan/kdf.h
 include/botan-3/botan/kyber.h
 include/botan-3/botan/lzma.h
@@ -86,6 +93,7 @@ include/botan-3/botan/mceliece.h
 include/botan-3/botan/mem_ops.h
 include/botan-3/botan/ml_dsa.h
 include/botan-3/botan/ml_kem.h
+include/botan-3/botan/module_lattice_keys.h
 include/botan-3/botan/mutex.h
 include/botan-3/botan/nist_keywrap.h
 include/botan-3/botan/numthry.h
@@ -112,10 +120,11 @@ include/botan-3/botan/pk_algs.h
 include/botan-3/botan/pk_keys.h
 include/botan-3/botan/pk_ops.h
 include/botan-3/botan/pk_ops_fwd.h
+include/botan-3/botan/pk_options.h
+include/botan-3/botan/pk_options_readers.h
 include/botan-3/botan/pkcs10.h
 include/botan-3/botan/pkcs11.h
-include/botan-3/botan/pkcs11f.h
-include/botan-3/botan/pkcs11t.h
+include/botan-3/botan/pkcs12.h
 include/botan-3/botan/pkcs8.h
 include/botan-3/botan/pkix_enums.h
 include/botan-3/botan/pkix_types.h
@@ -124,6 +133,7 @@ include/botan-3/botan/psk_db.h
 include/botan-3/botan/pss_params.h
 include/botan-3/botan/pubkey.h
 include/botan-3/botan/pwdhash.h
+include/botan-3/botan/range_concepts.h
 include/botan-3/botan/reducer.h
 include/botan-3/botan/rfc3394.h
 include/botan-3/botan/rfc4880.h
@@ -136,15 +146,18 @@ include/botan-3/botan/slh_dsa.h
 include/botan-3/botan/sm2.h
 include/botan-3/botan/sodium.h
 include/botan-3/botan/sp_parameters.h
+include/botan-3/botan/spake2p.h
 include/botan-3/botan/sphincsplus.h
 include/botan-3/botan/sqlite3.h
 include/botan-3/botan/srp6.h
 include/botan-3/botan/stateful_rng.h
 include/botan-3/botan/stream_cipher.h
 include/botan-3/botan/strong_type.h
+include/botan-3/botan/strong_type_helpers.h
 include/botan-3/botan/sym_algo.h
 include/botan-3/botan/symkey.h
 include/botan-3/botan/system_rng.h
+include/botan-3/botan/telephone_number.h
 include/botan-3/botan/tls.h
 include/botan-3/botan/tls_alert.h
 include/botan-3/botan/tls_algos.h
@@ -154,15 +167,21 @@ include/botan-3/botan/tls_ciphersuite.h
 include/botan-3/botan/tls_client.h
 include/botan-3/botan/tls_exceptn.h
 include/botan-3/botan/tls_extensions.h
+include/botan-3/botan/tls_extensions_12.h
+include/botan-3/botan/tls_extensions_13.h
 include/botan-3/botan/tls_external_psk.h
 include/botan-3/botan/tls_handshake_msg.h
 include/botan-3/botan/tls_magic.h
 include/botan-3/botan/tls_messages.h
+include/botan-3/botan/tls_messages_12.h
+include/botan-3/botan/tls_messages_13.h
 include/botan-3/botan/tls_policy.h
+include/botan-3/botan/tls_psk_13.h
 include/botan-3/botan/tls_psk_identity_13.h
 include/botan-3/botan/tls_server.h
 include/botan-3/botan/tls_server_info.h
 include/botan-3/botan/tls_session.h
+include/botan-3/botan/tls_session_id.h
 include/botan-3/botan/tls_session_manager.h
 include/botan-3/botan/tls_session_manager_hybrid.h
 include/botan-3/botan/tls_session_manager_memory.h
@@ -174,8 +193,10 @@ include/botan-3/botan/tls_signature_sche
 include/botan-3/botan/tls_version.h
 include/botan-3/botan/tss.h
 include/botan-3/botan/types.h
+include/botan-3/botan/uri.h
 include/botan-3/botan/uuid.h
 include/botan-3/botan/version.h
+include/botan-3/botan/work_executor.h
 include/botan-3/botan/x25519.h
 include/botan-3/botan/x448.h
 include/botan-3/botan/x509_ca.h
@@ -195,13 +216,14 @@ lib/cmake/Botan-${PKGVERSION}/botan-conf
 lib/cmake/Botan-${PKGVERSION}/botan-config.cmake
 lib/libbotan-3.a
 lib/libbotan-3.so
-lib/libbotan-3.so.9
-lib/libbotan-3.so.9.9.0
+lib/libbotan-3.so.14
+lib/libbotan-3.so.14.14.0
 lib/pkgconfig/botan-3.pc
 share/doc/${PKGNAME}/authors.txt
 share/doc/${PKGNAME}/handbook/abi.rst
 share/doc/${PKGNAME}/handbook/api_ref/bigint.rst
 share/doc/${PKGNAME}/handbook/api_ref/block_cipher.rst
+share/doc/${PKGNAME}/handbook/api_ref/bls12_381.rst
 share/doc/${PKGNAME}/handbook/api_ref/cipher_modes.rst
 share/doc/${PKGNAME}/handbook/api_ref/compression.rst
 share/doc/${PKGNAME}/handbook/api_ref/contents.rst
@@ -209,19 +231,23 @@ share/doc/${PKGNAME}/handbook/api_ref/cr
 share/doc/${PKGNAME}/handbook/api_ref/cryptobox.rst
 share/doc/${PKGNAME}/handbook/api_ref/ec_group.rst
 share/doc/${PKGNAME}/handbook/api_ref/ecc.rst
+share/doc/${PKGNAME}/handbook/api_ref/encoding.rst
 share/doc/${PKGNAME}/handbook/api_ref/env_vars.rst
 share/doc/${PKGNAME}/handbook/api_ref/ffi.rst
 share/doc/${PKGNAME}/handbook/api_ref/filters.rst
 share/doc/${PKGNAME}/handbook/api_ref/footguns.rst
 share/doc/${PKGNAME}/handbook/api_ref/fpe.rst
 share/doc/${PKGNAME}/handbook/api_ref/hash.rst
+share/doc/${PKGNAME}/handbook/api_ref/hpke.rst
 share/doc/${PKGNAME}/handbook/api_ref/kdf.rst
 share/doc/${PKGNAME}/handbook/api_ref/keywrap.rst
 share/doc/${PKGNAME}/handbook/api_ref/message_auth_codes.rst
+share/doc/${PKGNAME}/handbook/api_ref/names.rst
 share/doc/${PKGNAME}/handbook/api_ref/otp.rst
 share/doc/${PKGNAME}/handbook/api_ref/passhash.rst
 share/doc/${PKGNAME}/handbook/api_ref/pbkdf.rst
 share/doc/${PKGNAME}/handbook/api_ref/pkcs11.rst
+share/doc/${PKGNAME}/handbook/api_ref/pkcs12.rst
 share/doc/${PKGNAME}/handbook/api_ref/providers.rst
 share/doc/${PKGNAME}/handbook/api_ref/psk_db.rst
 share/doc/${PKGNAME}/handbook/api_ref/pubkey.rst
@@ -230,8 +256,10 @@ share/doc/${PKGNAME}/handbook/api_ref/rn
 share/doc/${PKGNAME}/handbook/api_ref/roughtime.rst
 share/doc/${PKGNAME}/handbook/api_ref/secmem.rst
 share/doc/${PKGNAME}/handbook/api_ref/sodium.rst
+share/doc/${PKGNAME}/handbook/api_ref/spake2p.rst
 share/doc/${PKGNAME}/handbook/api_ref/srp.rst
 share/doc/${PKGNAME}/handbook/api_ref/stream_ciphers.rst
+share/doc/${PKGNAME}/handbook/api_ref/thread_pool.rst
 share/doc/${PKGNAME}/handbook/api_ref/tls.rst
 share/doc/${PKGNAME}/handbook/api_ref/tpm.rst
 share/doc/${PKGNAME}/handbook/api_ref/tss.rst

Index: pkgsrc/security/botan3/buildlink3.mk
diff -u pkgsrc/security/botan3/buildlink3.mk:1.12 pkgsrc/security/botan3/buildlink3.mk:1.13
--- pkgsrc/security/botan3/buildlink3.mk:1.12   Mon Aug 24 08:42:29 2026
+++ pkgsrc/security/botan3/buildlink3.mk        Thu Nov  5 11:11:14 2026
@@ -1,4 +1,4 @@
-# $NetBSD: buildlink3.mk,v 1.12 2026/08/24 08:42:29 adam Exp $
+# $NetBSD: buildlink3.mk,v 1.13 2026/11/05 11:11:14 nros Exp $
 
 BUILDLINK_TREE+=       botan3
 
@@ -6,7 +6,7 @@ BUILDLINK_TREE+=        botan3
 BOTAN3_BUILDLINK3_MK:=
 
 BUILDLINK_API_DEPENDS.botan3+= botan3>=3.0.0
-BUILDLINK_ABI_DEPENDS.botan3+= botan3>=3.9.0nb3
+BUILDLINK_ABI_DEPENDS.botan3+= botan3>=3.14.0
 BUILDLINK_PKGSRCDIR.botan3?=   ../../security/botan3
 
 .include "../../devel/boost-libs/buildlink3.mk"

Index: pkgsrc/security/botan3/distinfo
diff -u pkgsrc/security/botan3/distinfo:1.9 pkgsrc/security/botan3/distinfo:1.10
--- pkgsrc/security/botan3/distinfo:1.9 Sun Oct 19 13:45:30 2025
+++ pkgsrc/security/botan3/distinfo     Thu Nov  5 11:11:14 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.9 2025/10/19 13:45:30 adam Exp $
+$NetBSD: distinfo,v 1.10 2026/11/05 11:11:14 nros Exp $
 
-BLAKE2s (Botan-3.9.0.tar.xz) = 1bc9b14c45fbecb6b59da6b04ebd97e679744c3d4aef3775a629ddf43356d1c5
-SHA512 (Botan-3.9.0.tar.xz) = 50fc581d120619dc8ceadff8f2c6a831992fbb7c74621edcfb266f2bc973e66723e15d855fdad96f46204bdcdb957609c506e02d2d7edbecb67eb54b4bd96fc6
-Size (Botan-3.9.0.tar.xz) = 8769364 bytes
-SHA1 (patch-src_scripts_install.py) = c8ac2a6315e0e53a0292447e8e6b967572de9d24
+BLAKE2s (Botan-3.14.0.tar.xz) = d2933778c9225a1460af5daa3876c411d7f010f3b672ce8eff125bc7702067fb
+SHA512 (Botan-3.14.0.tar.xz) = efe2bbdba9ed8f0f5c4e81ec3fa6a5df795a02085e55f5f281758c0315bd4d1f27f3a42005d67aa38d88444a9a01880c515976aeb1ba632bcd7c84550f5ad770
+Size (Botan-3.14.0.tar.xz) = 10307308 bytes
+SHA1 (patch-src_scripts_install.py) = 2b979a529a26863cb6ac5657ed3e684bfecb4c08

Index: pkgsrc/security/botan3/patches/patch-src_scripts_install.py
diff -u pkgsrc/security/botan3/patches/patch-src_scripts_install.py:1.1 pkgsrc/security/botan3/patches/patch-src_scripts_install.py:1.2
--- pkgsrc/security/botan3/patches/patch-src_scripts_install.py:1.1     Mon Jun 26 11:40:39 2023
+++ pkgsrc/security/botan3/patches/patch-src_scripts_install.py Thu Nov  5 11:11:14 2026
@@ -1,10 +1,10 @@
-$NetBSD: patch-src_scripts_install.py,v 1.1 2023/06/26 11:40:39 wiz Exp $
+$NetBSD: patch-src_scripts_install.py,v 1.2 2026/11/05 11:11:14 nros Exp $
 
 * install docs into share/doc/${PKGNAME}
 
 --- src/scripts/install.py.orig        2022-01-29 07:12:00.830197062 +0000
 +++ src/scripts/install.py
-@@ -214,7 +214,7 @@ def main(args):
+@@ -230,7 +230,7 @@ def main(args):
  
      if cfg['with_documentation']:
          target_doc_dir = os.path.join(prefix, cfg['docdir'],

Index: pkgsrc/security/py-botan3/Makefile
diff -u pkgsrc/security/py-botan3/Makefile:1.10 pkgsrc/security/py-botan3/Makefile:1.11
--- pkgsrc/security/py-botan3/Makefile:1.10     Mon Aug 24 08:42:30 2026
+++ pkgsrc/security/py-botan3/Makefile  Thu Nov  5 11:11:15 2026
@@ -1,6 +1,5 @@
-# $NetBSD: Makefile,v 1.10 2026/08/24 08:42:30 adam Exp $
+# $NetBSD: Makefile,v 1.11 2026/11/05 11:11:15 nros Exp $
 
-PKGREVISION= 2
 .include "../../security/botan3/Makefile.common"
 
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:S/Botan/botan3/}