BSD Ports

Vulnerable: version 1.7.6 is affected by 2 known vulnerabilities. See below.

www/privatebin 1.7.6 DragonFly

Simple end-to-end encrypting zero-knowledge paste-bin server

System
DragonFly
Repository
DPorts
Maintainer
[email protected] (as in FreeBSD)
License
ZLIB
Categories
security, www
Package size
610.5 KiB, 3168.8 KiB installed

Description

PrivateBin is a minimalist, open source online pastebin where the server has zero knowledge of pasted data.

Data is encrypted/decrypted in the browser using 256bit AES in Galois Counter mode.

This is a fork of ZeroBin, originally developed by Sebastien Sauvage. It was refactored to allow easier and cleaner extensions and has now much more features than the original. It is however still fully compatible to the original ZeroBin 0.19 data storage scheme. Therefore such installations can be upgraded to this fork without losing any data.

Since the Javascript code that performs the encryption must be protected during transmission, access to PrivateBin must only be possible over HTTPS (e.g. enforced by use of HSTS and/or HPKP).

See https://github.com/PrivateBin/PrivateBin/wiki/Configuration for configuration options available in "cfg/conf.php".

In the other systems

SystemPortVersion
DragonFlywww/privatebin1.7.6
FreeBSDwww/privatebin2.1.0
HardenedBSDwww/privatebin2.0.6
GhostBSDwww/privatebin2.0.6

Install

Binary package:

pkg install privatebin

From DPorts:

cd /usr/dports/www/privatebin && make install clean

Dependencies

Run dependencies 5

No port depends on this one.

Configuration

No options to configure.

Service scripts
none

Message after installing

------------------------------------------------------------------------------

If you are no longer using the privatebin port, then manually delete
the following directory and all its contents:

	/var/db/privatebin

------------------------------------------------------------------------------

Known vulnerabilities 2