Update to 4.3.22

(cherry picked from commit 07e81785d2ad06b7a7a26899a79b9aa1d284f6d2)
- Update to 4.3.24
- Don't attempt to remove directories owned by a dependency

(cherry picked from commit 9f037db57408f9dc215cde42e64497d591017f53)
- Update to patch level 25 (4.3.25)
- Provide CPE information [1]

Provided by:    des
Notified by:	Chet Ramey <chet.ramey@case.edu>

(cherry picked from commit 9393e60e648dbcc98ce5ea06c8d7dd5a62d6dc2c)
Disable function importing from the environment by default.  This can be
enabled by using --import-functions or enabling the IMPORTFUNCTIONS option.

This removes the risk of further parser bugs leading to code execution, as
well as the risk to setuid scripts and poorly written applications that
do not cleanse their environment [1][2].

Also note that there is an unofficial 4.3.26 floating around that has not yet
been officially released.  r369261 covers the change in 4.3.26.

See also:
  http://seclists.org/oss-sec/2014/q3/747 [1]
  http://seclists.org/oss-sec/2014/q3/746 [2]
  http://seclists.org/oss-sec/2014/q3/755 [3]

Obtained from:	NetBSD (based on) [3]
PR:		193932
Reviewed by:	Eric Vangyzen
With hat:	portmgr

(cherry picked from commit 96ee895213076944656013cdb7856322a6e74ac8)
Update to patchlevel 26. This is a NOP as r369261 already covered it.

(cherry picked from commit d94cd97db65622ec69a92655d5e2361b3e23e492)
- Update to patchlevel 27 which changes how functions are exported.
  This should eliminate the recent vulnerabilities, but keep the
  requirement for --import-functions/IMPORTFUNCTIONS option for now.
- Loosen the --import-functions requirement so it is not needed when running
  an interactive shell. It is already disallowed for privileged/setuid mode.
- Show an error on stderr when an imported function is ignored.

(cherry picked from commit 8fd67508e33a40b1ba954f903c5208b3a361c3a0)
Add RedHat's patch for CVE-2014-7186, commonly known as "redir_stack" overflow,
which has not been shown to be as critical as "shellshock" currently.

Security:	CVE-2014-7186
(cherry picked from commit 88bd061ef83b7ef04241de4d98b537f7db57e363)
MFH: r369784

- Update to patchlevel 28 which fixes issues that were mostly addressed
  already in r369684.

(cherry picked from commit c98391cf1010f60138b2163d7844a3eb721a5e49)
MFH: r369921

- Update to patchlevel 4.3.29.

  This addresses the local crash from CVE-2014-6277. Note that
  the fixes applied in 4.3.25_2 (and upstream 4.3.27) already made
  this non-exploitable remotely.

  This makes 'bashcheck' [1] fully green now. It had a soft warning
  before for CVE-2014-6277.

[1] https://github.com/hannob/bashcheck

(cherry picked from commit 2b7398224797a98633864b15d0d06b66d23179d7)
MFH: r370147

Update to 4.3.30

(cherry picked from commit aed5e93d4cd02d454119f21640bdb841a4bdb3eb)
[Bug 5806]
Add USE_AUTOTOOLS=autoconf to force configure script to be rebuilt
with the patched configure.in -- otherwise, --enable-ssl is ignored,
and that's bad.

(cherry picked from commit 256598288e7198af135c7b1a3a057a3a6ba0db77)