From f55346e79663ba411a506b010f1a3d2bb20010c72d8c1b1caa98785ef287d7c5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 2 Nov 2021 13:52:40 +0000 Subject: [PATCH 1/2] Accepting request 928797 from utilities OBS-URL: https://build.opensuse.org/request/show/928797 OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/libssh?expand=0&rev=71 --- libssh.changes | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/libssh.changes b/libssh.changes index ae8508f..5d5b6d2 100644 --- a/libssh.changes +++ b/libssh.changes @@ -29,6 +29,14 @@ Thu Apr 9 07:50:07 UTC 2020 - Andreas Schneider - Update to version 0.9.4 * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ +------------------------------------------------------------------- +Thu Apr 9 07:50:07 UTC 2020 - Andreas Schneider + +- Update to version 0.9.4 + * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ + * Fix possible Denial of Service attack when using AES-CTR-ciphers + CVE-2020-1730 (bsc#1168699) + ------------------------------------------------------------------- Tue Feb 18 14:05:49 UTC 2020 - Dominique Leuenberger @@ -54,6 +62,24 @@ Tue Dec 10 19:08:47 UTC 2019 - Andreas Schneider * SSH-01-009 SSH: Update documentation which RFCs are implemented * SSH-01-012 PKI: Information leak via uninitialized stack buffer +------------------------------------------------------------------- +Tue Dec 10 19:08:47 UTC 2019 - Andreas Schneider + +- Update to version 0.9.3 + * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095) + * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state + * SSH-01-006 General: Various unchecked Null-derefs cause DOS + * SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys + * SSH-01-010 SSH: Deprecated hash function in fingerprinting + * SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS + * SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access + * SSH-01-001 State Machine: Initial machine states should be set explicitly + * SSH-01-002 Kex: Differently bound macros used to iterate same array + * SSH-01-005 Code-Quality: Integer sign confusion during assignments + * SSH-01-008 SCP: Protocol Injection via unescaped File Names + * SSH-01-009 SSH: Update documentation which RFCs are implemented + * SSH-01-012 PKI: Information leak via uninitialized stack buffer + ------------------------------------------------------------------- Mon Dec 9 09:25:43 UTC 2019 - Dominique Leuenberger From 4397453d7f88225af6eb07bfe06246b929ba926060f0404bef142082b3e910ce Mon Sep 17 00:00:00 2001 From: OBS User buildservice-autocommit Date: Wed, 3 Nov 2021 16:26:03 +0000 Subject: [PATCH 2/2] Updating link to change in openSUSE:Factory/libssh revision 65.0 OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/libssh?expand=0&rev=ae1e25cb1ee0938fd102d26e2e01fc9a --- libssh.changes | 24 ------------------------ 1 file changed, 24 deletions(-) diff --git a/libssh.changes b/libssh.changes index 5d5b6d2..082576f 100644 --- a/libssh.changes +++ b/libssh.changes @@ -26,12 +26,6 @@ Sun Sep 13 19:17:44 UTC 2020 - Dirk Mueller ------------------------------------------------------------------- Thu Apr 9 07:50:07 UTC 2020 - Andreas Schneider -- Update to version 0.9.4 - * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ - -------------------------------------------------------------------- -Thu Apr 9 07:50:07 UTC 2020 - Andreas Schneider - - Update to version 0.9.4 * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ * Fix possible Denial of Service attack when using AES-CTR-ciphers @@ -47,24 +41,6 @@ Tue Feb 18 14:05:49 UTC 2020 - Dominique Leuenberger ------------------------------------------------------------------- Tue Dec 10 19:08:47 UTC 2019 - Andreas Schneider -- Update to version 0.9.3 - * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution - * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state - * SSH-01-006 General: Various unchecked Null-derefs cause DOS - * SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys - * SSH-01-010 SSH: Deprecated hash function in fingerprinting - * SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS - * SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access - * SSH-01-001 State Machine: Initial machine states should be set explicitly - * SSH-01-002 Kex: Differently bound macros used to iterate same array - * SSH-01-005 Code-Quality: Integer sign confusion during assignments - * SSH-01-008 SCP: Protocol Injection via unescaped File Names - * SSH-01-009 SSH: Update documentation which RFCs are implemented - * SSH-01-012 PKI: Information leak via uninitialized stack buffer - -------------------------------------------------------------------- -Tue Dec 10 19:08:47 UTC 2019 - Andreas Schneider - - Update to version 0.9.3 * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095) * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state