Accepting request 1133933 from network
Added openssh-cve-2023-48795.patch (forwarded request 1133932 from hpjansson) OBS-URL: https://build.opensuse.org/request/show/1133933 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssh?expand=0&rev=169
This commit is contained in:
Ana Guerrero
Git OBS Bridge
commit
b339dda6d3
399
openssh-cve-2023-48795.patch
Normal file
399
openssh-cve-2023-48795.patch
Normal file
@ -0,0 +1,399 @@
|
|||||||
|
Index: openssh-9.3p2/PROTOCOL
|
||||||
|
===================================================================
|
||||||
|
--- openssh-9.3p2.orig/PROTOCOL
|
||||||
|
+++ openssh-9.3p2/PROTOCOL
|
||||||
|
@@ -104,6 +104,25 @@ http://git.libssh.org/users/aris/libssh.
|
||||||
|
|
||||||
|
This is identical to curve25519-sha256 as later published in RFC8731.
|
||||||
|
|
||||||
|
+1.9 transport: strict key exchange extension
|
||||||
|
+
|
||||||
|
+OpenSSH supports a number of transport-layer hardening measures under
|
||||||
|
+a "strict KEX" feature. This feature is signalled similarly to the
|
||||||
|
+RFC8305 ext-info feature: by including a additional algorithm in the
|
||||||
|
+SSH2_MSG_KEXINIT kex_algorithms field. The client may append
|
||||||
|
+"kex-strict-c-v00@openssh.com" to its kex_algorithms and the server
|
||||||
|
+may append "kex-strict-s-v00@openssh.com".
|
||||||
|
+
|
||||||
|
+When endpoint that supports this extension observes this algorithm
|
||||||
|
+name in a peer's KEXINIT packet, it MUST make the following changes to
|
||||||
|
+the the protocol:
|
||||||
|
+
|
||||||
|
+a) During initial KEX, terminate the connection if any unexpected or
|
||||||
|
+ out-of-sequence packet is received. This includes terminating the
|
||||||
|
+ connection if the first packet received is not SSH2_MSG_KEXINIT.
|
||||||
|
+b) At each SSH2_MSG_NEWKEYS message, reset the packet sequence number
|
||||||
|
+ to zero.
|
||||||
|
+
|
||||||
|
2. Connection protocol changes
|
||||||
|
|
||||||
|
2.1. connection: Channel write close extension "eow@openssh.com"
|
||||||
|
Index: openssh-9.3p2/kex.c
|
||||||
|
===================================================================
|
||||||
|
--- openssh-9.3p2.orig/kex.c
|
||||||
|
+++ openssh-9.3p2/kex.c
|
||||||
|
@@ -76,7 +76,7 @@
|
||||||
|
#include "fips.h"
|
||||||
|
|
||||||
|
/* prototype */
|
||||||
|
-static int kex_choose_conf(struct ssh *);
|
||||||
|
+static int kex_choose_conf(struct ssh *, uint32_t seq);
|
||||||
|
static int kex_input_newkeys(int, u_int32_t, struct ssh *);
|
||||||
|
|
||||||
|
static const char * const proposal_names[PROPOSAL_MAX] = {
|
||||||
|
@@ -261,6 +261,18 @@ kex_names_valid(const char *names)
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
+/* returns non-zero if proposal contains any algorithm from algs */
|
||||||
|
+static int
|
||||||
|
+has_any_alg(const char *proposal, const char *algs)
|
||||||
|
+{
|
||||||
|
+ char *cp;
|
||||||
|
+
|
||||||
|
+ if ((cp = match_list(proposal, algs, NULL)) == NULL)
|
||||||
|
+ return 0;
|
||||||
|
+ free(cp);
|
||||||
|
+ return 1;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* Concatenate algorithm names, avoiding duplicates in the process.
|
||||||
|
* Caller must free returned string.
|
||||||
|
@@ -268,7 +280,7 @@ kex_names_valid(const char *names)
|
||||||
|
char *
|
||||||
|
kex_names_cat(const char *a, const char *b)
|
||||||
|
{
|
||||||
|
- char *ret = NULL, *tmp = NULL, *cp, *p, *m;
|
||||||
|
+ char *ret = NULL, *tmp = NULL, *cp, *p;
|
||||||
|
size_t len;
|
||||||
|
|
||||||
|
if (a == NULL || *a == '\0')
|
||||||
|
@@ -285,10 +297,8 @@ kex_names_cat(const char *a, const char
|
||||||
|
}
|
||||||
|
strlcpy(ret, a, len);
|
||||||
|
for ((p = strsep(&cp, ",")); p && *p != '\0'; (p = strsep(&cp, ","))) {
|
||||||
|
- if ((m = match_list(ret, p, NULL)) != NULL) {
|
||||||
|
- free(m);
|
||||||
|
+ if (has_any_alg(ret, p))
|
||||||
|
continue; /* Algorithm already present */
|
||||||
|
- }
|
||||||
|
if (strlcat(ret, ",", len) >= len ||
|
||||||
|
strlcat(ret, p, len) >= len) {
|
||||||
|
free(tmp);
|
||||||
|
@@ -441,15 +451,23 @@ kex_proposal_populate_entries(struct ssh
|
||||||
|
const char *defpropclient[PROPOSAL_MAX] = { KEX_CLIENT };
|
||||||
|
const char **defprop = ssh->kex->server ? defpropserver : defpropclient;
|
||||||
|
u_int i;
|
||||||
|
+ char *cp;
|
||||||
|
|
||||||
|
if (prop == NULL)
|
||||||
|
fatal_f("proposal missing");
|
||||||
|
|
||||||
|
+ /* Append EXT_INFO signalling to KexAlgorithms */
|
||||||
|
+ if (kexalgos == NULL)
|
||||||
|
+ kexalgos = defprop[PROPOSAL_KEX_ALGS];
|
||||||
|
+ if ((cp = kex_names_cat(kexalgos, ssh->kex->server ?
|
||||||
|
+ "kex-strict-s-v00@openssh.com" :
|
||||||
|
+ "ext-info-c,kex-strict-c-v00@openssh.com")) == NULL)
|
||||||
|
+ fatal_f("kex_names_cat");
|
||||||
|
+
|
||||||
|
for (i = 0; i < PROPOSAL_MAX; i++) {
|
||||||
|
switch(i) {
|
||||||
|
case PROPOSAL_KEX_ALGS:
|
||||||
|
- prop[i] = compat_kex_proposal(ssh,
|
||||||
|
- kexalgos ? kexalgos : defprop[i]);
|
||||||
|
+ prop[i] = compat_kex_proposal(ssh, cp);
|
||||||
|
break;
|
||||||
|
case PROPOSAL_ENC_ALGS_CTOS:
|
||||||
|
case PROPOSAL_ENC_ALGS_STOC:
|
||||||
|
@@ -470,6 +488,7 @@ kex_proposal_populate_entries(struct ssh
|
||||||
|
prop[i] = xstrdup(defprop[i]);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
+ free(cp);
|
||||||
|
}
|
||||||
|
|
||||||
|
void
|
||||||
|
@@ -573,7 +592,12 @@ kex_protocol_error(int type, u_int32_t s
|
||||||
|
{
|
||||||
|
int r;
|
||||||
|
|
||||||
|
- error("kex protocol error: type %d seq %u", type, seq);
|
||||||
|
+ /* If in strict mode, any unexpected message is an error */
|
||||||
|
+ if ((ssh->kex->flags & KEX_INITIAL) && ssh->kex->kex_strict) {
|
||||||
|
+ ssh_packet_disconnect(ssh, "strict KEX violation: "
|
||||||
|
+ "unexpected packet type %u (seqnr %u)", type, seq);
|
||||||
|
+ }
|
||||||
|
+ error_f("type %u seq %u", type, seq);
|
||||||
|
if ((r = sshpkt_start(ssh, SSH2_MSG_UNIMPLEMENTED)) != 0 ||
|
||||||
|
(r = sshpkt_put_u32(ssh, seq)) != 0 ||
|
||||||
|
(r = sshpkt_send(ssh)) != 0)
|
||||||
|
@@ -651,7 +675,7 @@ kex_input_ext_info(int type, u_int32_t s
|
||||||
|
if (ninfo >= 1024) {
|
||||||
|
error("SSH2_MSG_EXT_INFO with too many entries, expected "
|
||||||
|
"<=1024, received %u", ninfo);
|
||||||
|
- return SSH_ERR_INVALID_FORMAT;
|
||||||
|
+ return dispatch_protocol_error(type, seq, ssh);
|
||||||
|
}
|
||||||
|
for (i = 0; i < ninfo; i++) {
|
||||||
|
if ((r = sshpkt_get_cstring(ssh, &name, NULL)) != 0)
|
||||||
|
@@ -767,7 +791,7 @@ kex_input_kexinit(int type, u_int32_t se
|
||||||
|
error_f("no kex");
|
||||||
|
return SSH_ERR_INTERNAL_ERROR;
|
||||||
|
}
|
||||||
|
- ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, NULL);
|
||||||
|
+ ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, &kex_protocol_error);
|
||||||
|
ptr = sshpkt_ptr(ssh, &dlen);
|
||||||
|
if ((r = sshbuf_put(kex->peer, ptr, dlen)) != 0)
|
||||||
|
return r;
|
||||||
|
@@ -803,7 +827,7 @@ kex_input_kexinit(int type, u_int32_t se
|
||||||
|
if (!(kex->flags & KEX_INIT_SENT))
|
||||||
|
if ((r = kex_send_kexinit(ssh)) != 0)
|
||||||
|
return r;
|
||||||
|
- if ((r = kex_choose_conf(ssh)) != 0)
|
||||||
|
+ if ((r = kex_choose_conf(ssh, seq)) != 0)
|
||||||
|
return r;
|
||||||
|
|
||||||
|
if (kex->kex_type < KEX_MAX && kex->kex[kex->kex_type] != NULL)
|
||||||
|
@@ -1082,20 +1106,14 @@ proposals_match(char *my[PROPOSAL_MAX],
|
||||||
|
return (1);
|
||||||
|
}
|
||||||
|
|
||||||
|
-/* returns non-zero if proposal contains any algorithm from algs */
|
||||||
|
static int
|
||||||
|
-has_any_alg(const char *proposal, const char *algs)
|
||||||
|
+kexalgs_contains(char **peer, const char *ext)
|
||||||
|
{
|
||||||
|
- char *cp;
|
||||||
|
-
|
||||||
|
- if ((cp = match_list(proposal, algs, NULL)) == NULL)
|
||||||
|
- return 0;
|
||||||
|
- free(cp);
|
||||||
|
- return 1;
|
||||||
|
+ return has_any_alg(peer[PROPOSAL_KEX_ALGS], ext);
|
||||||
|
}
|
||||||
|
|
||||||
|
static int
|
||||||
|
-kex_choose_conf(struct ssh *ssh)
|
||||||
|
+kex_choose_conf(struct ssh *ssh, uint32_t seq)
|
||||||
|
{
|
||||||
|
struct kex *kex = ssh->kex;
|
||||||
|
struct newkeys *newkeys;
|
||||||
|
@@ -1120,13 +1138,23 @@ kex_choose_conf(struct ssh *ssh)
|
||||||
|
sprop=peer;
|
||||||
|
}
|
||||||
|
|
||||||
|
- /* Check whether client supports ext_info_c */
|
||||||
|
- if (kex->server && (kex->flags & KEX_INITIAL)) {
|
||||||
|
- char *ext;
|
||||||
|
-
|
||||||
|
- ext = match_list("ext-info-c", peer[PROPOSAL_KEX_ALGS], NULL);
|
||||||
|
- kex->ext_info_c = (ext != NULL);
|
||||||
|
- free(ext);
|
||||||
|
+ /* Check whether peer supports ext_info/kex_strict */
|
||||||
|
+ if ((kex->flags & KEX_INITIAL) != 0) {
|
||||||
|
+ if (kex->server) {
|
||||||
|
+ kex->ext_info_c = kexalgs_contains(peer, "ext-info-c");
|
||||||
|
+ kex->kex_strict = kexalgs_contains(peer,
|
||||||
|
+ "kex-strict-c-v00@openssh.com");
|
||||||
|
+ } else {
|
||||||
|
+ kex->kex_strict = kexalgs_contains(peer,
|
||||||
|
+ "kex-strict-s-v00@openssh.com");
|
||||||
|
+ }
|
||||||
|
+ if (kex->kex_strict) {
|
||||||
|
+ debug3_f("will use strict KEX ordering");
|
||||||
|
+ if (seq != 0)
|
||||||
|
+ ssh_packet_disconnect(ssh,
|
||||||
|
+ "strict KEX violation: "
|
||||||
|
+ "KEXINIT was not the first packet");
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Check whether client supports rsa-sha2 algorithms */
|
||||||
|
Index: openssh-9.3p2/kex.h
|
||||||
|
===================================================================
|
||||||
|
--- openssh-9.3p2.orig/kex.h
|
||||||
|
+++ openssh-9.3p2/kex.h
|
||||||
|
@@ -157,6 +157,7 @@ struct kex {
|
||||||
|
u_int kex_type;
|
||||||
|
char *server_sig_algs;
|
||||||
|
int ext_info_c;
|
||||||
|
+ int kex_strict;
|
||||||
|
struct sshbuf *my;
|
||||||
|
struct sshbuf *peer;
|
||||||
|
struct sshbuf *client_version;
|
||||||
|
Index: openssh-9.3p2/packet.c
|
||||||
|
===================================================================
|
||||||
|
--- openssh-9.3p2.orig/packet.c
|
||||||
|
+++ openssh-9.3p2/packet.c
|
||||||
|
@@ -1236,6 +1236,11 @@ ssh_packet_send2_wrapped(struct ssh *ssh
|
||||||
|
state->p_send.bytes += len;
|
||||||
|
sshbuf_reset(state->outgoing_packet);
|
||||||
|
|
||||||
|
+ if (type == SSH2_MSG_NEWKEYS && ssh->kex->kex_strict) {
|
||||||
|
+ debug_f("resetting send seqnr %u", state->p_send.seqnr);
|
||||||
|
+ state->p_send.seqnr = 0;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
if (type == SSH2_MSG_NEWKEYS)
|
||||||
|
r = ssh_set_newkeys(ssh, MODE_OUT);
|
||||||
|
else if (type == SSH2_MSG_USERAUTH_SUCCESS && state->server_side)
|
||||||
|
@@ -1364,8 +1369,7 @@ ssh_packet_read_seqnr(struct ssh *ssh, u
|
||||||
|
/* Stay in the loop until we have received a complete packet. */
|
||||||
|
for (;;) {
|
||||||
|
/* Try to read a packet from the buffer. */
|
||||||
|
- r = ssh_packet_read_poll_seqnr(ssh, typep, seqnr_p);
|
||||||
|
- if (r != 0)
|
||||||
|
+ if ((r = ssh_packet_read_poll_seqnr(ssh, typep, seqnr_p)) != 0)
|
||||||
|
break;
|
||||||
|
/* If we got a packet, return it. */
|
||||||
|
if (*typep != SSH_MSG_NONE)
|
||||||
|
@@ -1649,6 +1630,7 @@ ssh_packet_read_poll2(struct ssh *ssh, u
|
||||||
|
if ((r = sshbuf_consume(state->input, mac->mac_len)) != 0)
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
|
+
|
||||||
|
if (seqnr_p != NULL)
|
||||||
|
*seqnr_p = state->p_read.seqnr;
|
||||||
|
if (++state->p_read.seqnr == 0)
|
||||||
|
@@ -1718,6 +1700,10 @@ ssh_packet_read_poll2(struct ssh *ssh, u
|
||||||
|
#endif
|
||||||
|
/* reset for next packet */
|
||||||
|
state->packlen = 0;
|
||||||
|
+ if (*typep == SSH2_MSG_NEWKEYS && ssh->kex->kex_strict) {
|
||||||
|
+ debug_f("resetting read seqnr %u", state->p_read.seqnr);
|
||||||
|
+ state->p_read.seqnr = 0;
|
||||||
|
+ }
|
||||||
|
|
||||||
|
if ((r = ssh_packet_check_rekey(ssh)) != 0)
|
||||||
|
return r;
|
||||||
|
@@ -1738,10 +1724,39 @@ ssh_packet_read_poll_seqnr(struct ssh *s
|
||||||
|
r = ssh_packet_read_poll2(ssh, typep, seqnr_p);
|
||||||
|
if (r != 0)
|
||||||
|
return r;
|
||||||
|
- if (*typep) {
|
||||||
|
- state->keep_alive_timeouts = 0;
|
||||||
|
- DBG(debug("received packet type %d", *typep));
|
||||||
|
+ if (*typep == 0) {
|
||||||
|
+ /* no message ready */
|
||||||
|
+ return 0;
|
||||||
|
}
|
||||||
|
+ state->keep_alive_timeouts = 0;
|
||||||
|
+ DBG(debug("received packet type %d", *typep));
|
||||||
|
+
|
||||||
|
+ /* Always process disconnect messages */
|
||||||
|
+ if (*typep == SSH2_MSG_DISCONNECT) {
|
||||||
|
+ if ((r = sshpkt_get_u32(ssh, &reason)) != 0 ||
|
||||||
|
+ (r = sshpkt_get_string(ssh, &msg, NULL)) != 0)
|
||||||
|
+ return r;
|
||||||
|
+ /* Ignore normal client exit notifications */
|
||||||
|
+ do_log2(ssh->state->server_side &&
|
||||||
|
+ reason == SSH2_DISCONNECT_BY_APPLICATION ?
|
||||||
|
+ SYSLOG_LEVEL_INFO : SYSLOG_LEVEL_ERROR,
|
||||||
|
+ "Received disconnect from %s port %d:"
|
||||||
|
+ "%u: %.400s", ssh_remote_ipaddr(ssh),
|
||||||
|
+ ssh_remote_port(ssh), reason, msg);
|
||||||
|
+ free(msg);
|
||||||
|
+ return SSH_ERR_DISCONNECTED;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ /*
|
||||||
|
+ * Do not implicitly handle any messages here during initial
|
||||||
|
+ * KEX when in strict mode. They will be need to be allowed
|
||||||
|
+ * explicitly by the KEX dispatch table or they will generate
|
||||||
|
+ * protocol errors.
|
||||||
|
+ */
|
||||||
|
+ if (ssh->kex != NULL &&
|
||||||
|
+ (ssh->kex->flags & KEX_INITIAL) && ssh->kex->kex_strict)
|
||||||
|
+ return 0;
|
||||||
|
+ /* Implicitly handle transport-level messages */
|
||||||
|
switch (*typep) {
|
||||||
|
case SSH2_MSG_IGNORE:
|
||||||
|
debug3("Received SSH2_MSG_IGNORE");
|
||||||
|
@@ -1756,19 +1771,6 @@ ssh_packet_read_poll_seqnr(struct ssh *s
|
||||||
|
debug("Remote: %.900s", msg);
|
||||||
|
free(msg);
|
||||||
|
break;
|
||||||
|
- case SSH2_MSG_DISCONNECT:
|
||||||
|
- if ((r = sshpkt_get_u32(ssh, &reason)) != 0 ||
|
||||||
|
- (r = sshpkt_get_string(ssh, &msg, NULL)) != 0)
|
||||||
|
- return r;
|
||||||
|
- /* Ignore normal client exit notifications */
|
||||||
|
- do_log2(ssh->state->server_side &&
|
||||||
|
- reason == SSH2_DISCONNECT_BY_APPLICATION ?
|
||||||
|
- SYSLOG_LEVEL_INFO : SYSLOG_LEVEL_ERROR,
|
||||||
|
- "Received disconnect from %s port %d:"
|
||||||
|
- "%u: %.400s", ssh_remote_ipaddr(ssh),
|
||||||
|
- ssh_remote_port(ssh), reason, msg);
|
||||||
|
- free(msg);
|
||||||
|
- return SSH_ERR_DISCONNECTED;
|
||||||
|
case SSH2_MSG_UNIMPLEMENTED:
|
||||||
|
if ((r = sshpkt_get_u32(ssh, &seqnr)) != 0)
|
||||||
|
return r;
|
||||||
|
@@ -2300,6 +2302,7 @@ kex_to_blob(struct sshbuf *m, struct kex
|
||||||
|
(r = sshbuf_put_u32(m, kex->hostkey_type)) != 0 ||
|
||||||
|
(r = sshbuf_put_u32(m, kex->hostkey_nid)) != 0 ||
|
||||||
|
(r = sshbuf_put_u32(m, kex->kex_type)) != 0 ||
|
||||||
|
+ (r = sshbuf_put_u32(m, kex->kex_strict)) != 0 ||
|
||||||
|
(r = sshbuf_put_stringb(m, kex->my)) != 0 ||
|
||||||
|
(r = sshbuf_put_stringb(m, kex->peer)) != 0 ||
|
||||||
|
(r = sshbuf_put_stringb(m, kex->client_version)) != 0 ||
|
||||||
|
@@ -2462,6 +2465,7 @@ kex_from_blob(struct sshbuf *m, struct k
|
||||||
|
(r = sshbuf_get_u32(m, (u_int *)&kex->hostkey_type)) != 0 ||
|
||||||
|
(r = sshbuf_get_u32(m, (u_int *)&kex->hostkey_nid)) != 0 ||
|
||||||
|
(r = sshbuf_get_u32(m, &kex->kex_type)) != 0 ||
|
||||||
|
+ (r = sshbuf_get_u32(m, &kex->kex_strict)) != 0 ||
|
||||||
|
(r = sshbuf_get_stringb(m, kex->my)) != 0 ||
|
||||||
|
(r = sshbuf_get_stringb(m, kex->peer)) != 0 ||
|
||||||
|
(r = sshbuf_get_stringb(m, kex->client_version)) != 0 ||
|
||||||
|
@@ -2790,6 +2794,7 @@ sshpkt_disconnect(struct ssh *ssh, const
|
||||||
|
vsnprintf(buf, sizeof(buf), fmt, args);
|
||||||
|
va_end(args);
|
||||||
|
|
||||||
|
+ debug2_f("sending SSH2_MSG_DISCONNECT: %s", buf);
|
||||||
|
if ((r = sshpkt_start(ssh, SSH2_MSG_DISCONNECT)) != 0 ||
|
||||||
|
(r = sshpkt_put_u32(ssh, SSH2_DISCONNECT_PROTOCOL_ERROR)) != 0 ||
|
||||||
|
(r = sshpkt_put_cstring(ssh, buf)) != 0 ||
|
||||||
|
Index: openssh-9.3p2/sshconnect2.c
|
||||||
|
===================================================================
|
||||||
|
--- openssh-9.3p2.orig/sshconnect2.c
|
||||||
|
+++ openssh-9.3p2/sshconnect2.c
|
||||||
|
@@ -420,7 +420,6 @@ struct cauthmethod {
|
||||||
|
};
|
||||||
|
|
||||||
|
static int input_userauth_service_accept(int, u_int32_t, struct ssh *);
|
||||||
|
-static int input_userauth_ext_info(int, u_int32_t, struct ssh *);
|
||||||
|
static int input_userauth_success(int, u_int32_t, struct ssh *);
|
||||||
|
static int input_userauth_failure(int, u_int32_t, struct ssh *);
|
||||||
|
static int input_userauth_banner(int, u_int32_t, struct ssh *);
|
||||||
|
@@ -540,7 +539,7 @@ ssh_userauth2(struct ssh *ssh, const cha
|
||||||
|
|
||||||
|
ssh->authctxt = &authctxt;
|
||||||
|
ssh_dispatch_init(ssh, &input_userauth_error);
|
||||||
|
- ssh_dispatch_set(ssh, SSH2_MSG_EXT_INFO, &input_userauth_ext_info);
|
||||||
|
+ ssh_dispatch_set(ssh, SSH2_MSG_EXT_INFO, kex_input_ext_info);
|
||||||
|
ssh_dispatch_set(ssh, SSH2_MSG_SERVICE_ACCEPT, &input_userauth_service_accept);
|
||||||
|
ssh_dispatch_run_fatal(ssh, DISPATCH_BLOCK, &authctxt.success); /* loop until success */
|
||||||
|
pubkey_cleanup(ssh);
|
||||||
|
@@ -591,12 +590,6 @@ input_userauth_service_accept(int type,
|
||||||
|
return r;
|
||||||
|
}
|
||||||
|
|
||||||
|
-static int
|
||||||
|
-input_userauth_ext_info(int type, u_int32_t seqnr, struct ssh *ssh)
|
||||||
|
-{
|
||||||
|
- return kex_input_ext_info(type, seqnr, ssh);
|
||||||
|
-}
|
||||||
|
-
|
||||||
|
void
|
||||||
|
userauth(struct ssh *ssh, char *authlist)
|
||||||
|
{
|
||||||
|
@@ -675,6 +668,7 @@ input_userauth_success(int type, u_int32
|
||||||
|
free(authctxt->methoddata);
|
||||||
|
authctxt->methoddata = NULL;
|
||||||
|
authctxt->success = 1; /* break out */
|
||||||
|
+ ssh_dispatch_set(ssh, SSH2_MSG_EXT_INFO, dispatch_protocol_error);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
@ -1,3 +1,10 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Tue Dec 19 01:42:55 UTC 2023 - Hans Petter Jansson <hpj@suse.com>
|
||||||
|
|
||||||
|
- Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795).
|
||||||
|
This mitigates a prefix truncation attack that could be used to
|
||||||
|
undermine channel security.
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Fri Nov 3 10:44:14 UTC 2023 - Johannes Segitz <jsegitz@suse.com>
|
Fri Nov 3 10:44:14 UTC 2023 - Johannes Segitz <jsegitz@suse.com>
|
||||||
|
|
||||||
@ -28,6 +35,11 @@ Tue Oct 24 10:56:31 UTC 2023 - Dominique Leuenberger <dimstar@opensuse.org>
|
|||||||
- Add cb4ed12f.patch: Fix build using zlib 1.3. The check expected
|
- Add cb4ed12f.patch: Fix build using zlib 1.3. The check expected
|
||||||
a version in the form a.b.c[.d], which no longer matches 1.3.
|
a version in the form a.b.c[.d], which no longer matches 1.3.
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Wed Sep 27 06:28:57 UTC 2023 - Thorsten Kukuk <kukuk@suse.com>
|
||||||
|
|
||||||
|
- Disable SLP by default for Factory and ALP (bsc#1214884)
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Fri Jul 21 02:48:58 UTC 2023 - Simon Lees <sflees@suse.de>
|
Fri Jul 21 02:48:58 UTC 2023 - Simon Lees <sflees@suse.de>
|
||||||
|
|
||||||
|
|||||||
@ -124,6 +124,7 @@ Patch103: openssh-6.6p1-privsep-selinux.patch
|
|||||||
Patch104: openssh-6.6p1-keycat.patch
|
Patch104: openssh-6.6p1-keycat.patch
|
||||||
Patch105: openssh-6.6.1p1-selinux-contexts.patch
|
Patch105: openssh-6.6.1p1-selinux-contexts.patch
|
||||||
Patch106: openssh-7.6p1-cleanup-selinux.patch
|
Patch106: openssh-7.6p1-cleanup-selinux.patch
|
||||||
|
Patch107: openssh-cve-2023-48795.patch
|
||||||
BuildRequires: audit-devel
|
BuildRequires: audit-devel
|
||||||
BuildRequires: automake
|
BuildRequires: automake
|
||||||
BuildRequires: groff
|
BuildRequires: groff
|
||||||
@ -349,8 +350,10 @@ install -m 644 %{SOURCE15} %{buildroot}%{_sysconfdir}/pam.d/sshd
|
|||||||
install -d -m 755 %{buildroot}%{_localstatedir}/lib/sshd
|
install -d -m 755 %{buildroot}%{_localstatedir}/lib/sshd
|
||||||
install -d -m 755 %{buildroot}%{_sysconfdir}/ssh/ssh_config.d
|
install -d -m 755 %{buildroot}%{_sysconfdir}/ssh/ssh_config.d
|
||||||
install -d -m 755 %{buildroot}%{_sysconfdir}/ssh/sshd_config.d
|
install -d -m 755 %{buildroot}%{_sysconfdir}/ssh/sshd_config.d
|
||||||
|
%if 0%{?suse_version} < 1600
|
||||||
install -d -m 755 %{buildroot}%{_sysconfdir}/slp.reg.d/
|
install -d -m 755 %{buildroot}%{_sysconfdir}/slp.reg.d/
|
||||||
install -m 644 %{SOURCE5} %{buildroot}%{_sysconfdir}/slp.reg.d/
|
install -m 644 %{SOURCE5} %{buildroot}%{_sysconfdir}/slp.reg.d/
|
||||||
|
%endif
|
||||||
install -D -m 0644 %{SOURCE10} %{buildroot}%{_unitdir}/sshd.service
|
install -D -m 0644 %{SOURCE10} %{buildroot}%{_unitdir}/sshd.service
|
||||||
ln -s service %{buildroot}%{_sbindir}/rcsshd
|
ln -s service %{buildroot}%{_sbindir}/rcsshd
|
||||||
install -d -m 755 %{buildroot}%{_fillupdir}
|
install -d -m 755 %{buildroot}%{_fillupdir}
|
||||||
@ -500,8 +503,10 @@ test -f /etc/ssh/ssh_config.rpmsave && mv -v /etc/ssh/ssh_config.rpmsave /etc/ss
|
|||||||
%attr(0444,root,root) %{_mandir}/man8/sftp-server.8*
|
%attr(0444,root,root) %{_mandir}/man8/sftp-server.8*
|
||||||
%attr(0444,root,root) %{_mandir}/man8/sshd.8*
|
%attr(0444,root,root) %{_mandir}/man8/sshd.8*
|
||||||
%attr(0755,root,root) %{_libexecdir}/ssh/sftp-server
|
%attr(0755,root,root) %{_libexecdir}/ssh/sftp-server
|
||||||
|
%if 0%{?suse_version} < 1600
|
||||||
%dir %{_sysconfdir}/slp.reg.d
|
%dir %{_sysconfdir}/slp.reg.d
|
||||||
%config %{_sysconfdir}/slp.reg.d/ssh.reg
|
%config %{_sysconfdir}/slp.reg.d/ssh.reg
|
||||||
|
%endif
|
||||||
%{_fillupdir}/sysconfig.ssh
|
%{_fillupdir}/sysconfig.ssh
|
||||||
%if 0%{?suse_version} < 1550
|
%if 0%{?suse_version} < 1550
|
||||||
%dir %{_fwdir}
|
%dir %{_fwdir}
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user