35f0e177c1- Enable --with-logind to call the SetTTY dbus method in systemd in SLE15 too. This allows "wall" to print messages in ssh ttys (bsc#1239671) - Small fixes to unref the dbus session when any error occurs: * logind_set_tty.patch
devel
Antonio Larrosa2025-05-13 15:12:56 +00:00
92eb08400f- Disable seccomp_filter and rlimitsandbox sandbox for loongarch. seccomp_filter and rlimitsandbox not supported on loongarch64 yet.Antonio Larrosa2025-04-07 10:00:08 +00:00
d77e0c9092- Update to openssh 9.9p2: = Security * Fix CVE-2025-26465 - ssh(1) in OpenSSH versions 6.8p1 to 9.9p1 (inclusive) contained a logic error that allowed an on-path attacker (a.k.a MITM) to impersonate any server when the VerifyHostKeyDNS option is enabled. This option is off by default. * Fix CVE-2025-26466 - sshd(8) in OpenSSH versions 9.5p1 to 9.9p1 (inclusive) is vulnerable to a memory/CPU denial-of-service related to the handling of SSH2_MSG_PING packets. This condition may be mitigated using the existing PerSourcePenalties feature. Both vulnerabilities were discovered and demonstrated to be exploitable by the Qualys Security Advisory team. The openSSH team thanks them for their detailed review of OpenSSH. = Bugfixes * ssh(1), sshd(8): fix regression in Match directive that caused failures when predicates and their arguments were separated by '=' characters instead of whitespace (bz3739). * sshd(8): fix the "Match invalid-user" predicate, which was matching incorrectly in the initial pass of config evaluation. * ssh(1), sshd(8), ssh-keyscan(1): fix mlkem768x25519-sha256 key exchange on big-endian systems. * Fix a number of build problems on particular operating systems and configurations. - Remove patches that are already included in 9.9p2: * 0001-fix-utmpx-ifdef.patch * 0002-upstream-fix-regression-introduced-when-I-switched-the-Match.patch * 0003-upstream-fix-previous-change-to-ssh_config-Match_-which-broken-on.patch * 0004-upstream-fix-ML-KEM768x25519-KEX-on-big-endian-systems-spotted-by.patchAntonio Larrosa2025-02-18 09:56:28 +00:00
d7201bdb47- Fix a MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client and a DoS attack against OpenSSH's client and server (bsc#1237040, CVE-2025-26465, bsc#1237041, CVE-2025-26466): * fix-CVE-2025-26465-and-CVE-2025-26466.patchAntonio Larrosa2025-02-18 09:10:29 +00:00
717dd2da2c- Don't force using gcc11 on SLFO/ALP which have a newer version.Antonio Larrosa2024-10-28 11:22:01 +00:00
33d804a345- Add patches from upstream: - To fix a copy&paste oversight in an ifdef : * 0001-fix-utmpx-ifdef.patch - To fix a regression introduced when the "Match" criteria tokenizer was modified since it stopped supporting the "Match criteria=argument" format: * 0002-upstream-fix-regression-introduced-when-I-switched-the-Match.patch - To fix the previous patch which broke on negated Matches: * 0003-upstream-fix-previous-change-to-ssh_config-Match_-which-broken-on.patch - To fix the ML-KEM768x25519 kex algorithm on big-endian systems: * 0004-upstream-fix-ML-KEM768x25519-KEX-on-big-endian-systems-spotted-by.patchAntonio Larrosa2024-10-28 11:16:49 +00:00
a77a72fabb- Add a const to the openssl 1.1/RSA section of sshkey_is_private to keep it similar to what it used before the 9.9 rebase: * openssh-8.1p1-audit.patch - Add a openssl11 bcond to the spec file for the SLE12 case instead of checking suse_version in different parts. - Move conditional patches to a number >= 1000.Antonio Larrosa2024-09-25 11:55:37 +00:00
3f6eda5c88- Update to openssh 9.9p1: * No changes for askpass, see main package changelog for details.Marcus Meissner2024-09-25 08:42:29 +00:00
fef1b16e66- Drop most of openssh-6.6p1-keycat.patch (actually, it was just commented out). The keycat binary isn't really installed nor supported, so we can drop it, except for the code that is used by other SELinux patches, which is what I kept from that patch (boo#1229072). - Add patch submitted to upstream to fix RFC4256 implementation so that keyboard-interactive authentication method can send instructions and sshd shows them to users even before a prompt is requested. This fixes MFA push notifications (boo#1229010). * 0001-auth-pam-Immediately-report-instructions-to-clients-and-fix-handling-in-ssh-client.patchAntonio Larrosa2024-09-12 10:24:41 +00:00
dd9c4b9bb1- Add patch to fix sshd not logging in the audit failed login attempts (submitted to upstream in https://github.com/openssh/openssh-portable/pull/516): * fix-audit-fail-attempt.patch - Use --enable-dsa-keys when building openssh. It's required if the user sets the crypto-policy mode to LEGACY, where DSA keys should be allowed. The option was added by upstream in 9.7 and set to disabled by default. - These two changes fix 2 of the 3 issues reported in bsc#1229650.Antonio Larrosa2024-08-23 12:36:12 +00:00
869b2ae788- Add patch from upstream to fix proxy multiplexing mode: * 0001-upstream-fix-proxy-multiplexing-mode_-broken-when-keystroke.patch - Add patch from upstream to restore correctly sigprocmask * 0001-upstream-correctly-restore-sigprocmask-around-ppoll.patch - Add patch from upstream to fix a logic error in ObscureKeystrokeTiming that rendered this feature ineffective, allowing a passive observer to detect which network packets contained real keystrokes (bsc#1227318, CVE-2024-39894): * 0001-upstream-when-sending-ObscureKeystrokeTiming-chaff-packets_.patchAntonio Larrosa2024-07-05 19:01:36 +00:00
45f6d17800- Add obsoletes for openssh-server-config-rootlogin since that package existed for a brief period of time during SLE 15 SP6/ Leap 15.6 development but even if it was removed from the repositories before GM, some users might have it in their systems from having tried a beta/RC release (boo#1227350).Antonio Larrosa2024-07-05 11:34:53 +00:00
0aa4b1876f- Add patch to fix a race condition in a signal handler by removing the async-signal-unsafe code (CVE-2024-6387, bsc#1226642): * fix-CVE-2024-6387.patchAntonio Larrosa2024-07-01 11:50:15 +00:00
e92e6f5af4- limit to openssl < 3.0 as this version is not compatible (bsc#1205042) next version update will fix itDirk Mueller2022-12-15 16:35:54 +00:00
Ana Guerrero
Antonio Larrosa
Dominique Leuenberger
Marcus Meissner
Dirk Mueller
Hans Petter Jansson