mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-05-08 17:19:20 +00:00
Code Issues Projects Releases Wiki Activity

openssh: Upgrade 8.0p1 -> 8.1p1

Browse Source 
Drop upstream backport of integer overflow in XMSS private key parsing.
Add PACKAGECONFIG for kerberos, libedit and ldns. If api-documentation
is enabled then install man(7) manpages rather than catman pages.

License-Update: convert to UTF-8
(From OE-Core rev: b084fa095800c090389b9c00d66f109d7cd11455)

Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Alex Kiernan
2019-12-01 18:47:33 +00:00
committed by Richard Purdie
parent 7ce92685a1
commit 6fa4763974
2 changed files with 10 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-connectivity/openssh/openssh/0001-upstream-fix-integer-overflow-in-XMSS-private-key-pa.patch
-40
View File
@@ -1,40 +0,0 @@
From 2014fad3d28090b59d2f8a0971166c06e5fa6da6 Mon Sep 17 00:00:00 2001
From: Hongxu Jia <hongxu.jia@windriver.com>
Date: Fri, 18 Oct 2019 14:56:58 +0800
Subject: [PATCH] upstream: fix integer overflow in XMSS private key parsing.
Reported by Adam Zabrocki via SecuriTeam's SSH program.
Note that this code is experimental and not compiled by default.
ok markus@
OpenBSD-Commit-ID: cd0361896d15e8a1bac495ac583ff065ffca2be1
Signed-off-by: "djm@openbsd.org" <djm@openbsd.org>
Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/a546b17bbaeb12beac4c9aeed56f74a42b18a93a]
CVE: CVE-2019-16905
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
---
sshkey-xmss.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/sshkey-xmss.c b/sshkey-xmss.c
index aaae702..c57681a 100644
--- a/sshkey-xmss.c
+++ b/sshkey-xmss.c
@@ -977,7 +977,8 @@ sshkey_xmss_decrypt_state(const struct sshkey *k, struct sshbuf *encoded,
goto out;
}
/* check that an appropriate amount of auth data is present */
- if (sshbuf_len(encoded) < encrypted_len + authlen) {
+ if (sshbuf_len(encoded) < authlen ||
+ sshbuf_len(encoded) - authlen < encrypted_len) {
r = SSH_ERR_INVALID_FORMAT;
goto out;
}
--
2.7.4
meta/recipes-connectivity/openssh/openssh_8.0p1.bb → meta/recipes-connectivity/openssh/openssh_8.1p1.bb
+10 -5
View File
@@ -6,7 +6,7 @@ and for executing commands on a remote machine."
HOMEPAGE = "http://www.openssh.com/"
SECTION = "console/network"
LICENSE = "BSD & ISC & MIT"
LIC_FILES_CHKSUM = "file://LICENCE;md5=429658c6612f3a9b1293782366ab29d8"
LIC_FILES_CHKSUM = "file://LICENCE;md5=18d9e5a8b3dd1790d73502f50426d4d3"
DEPENDS = "zlib openssl virtual/crypt"
DEPENDS += "${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)}"
@@ -24,14 +24,13 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://fix-potential-signed-overflow-in-pointer-arithmatic.patch \
file://sshd_check_keys \
file://add-test-support-for-busybox.patch \
file://0001-upstream-fix-integer-overflow-in-XMSS-private-key-pa.patch \
"
SRC_URI[md5sum] = "bf050f002fe510e1daecd39044e1122d"
SRC_URI[sha256sum] = "bd943879e69498e8031eb6b7f44d08cdc37d59a7ab689aa0b437320c3481fd68"
SRC_URI[md5sum] = "513694343631a99841e815306806edf0"
SRC_URI[sha256sum] = "02f5dbef3835d0753556f973cd57b4c19b6b1f6cd24c03445e23ac77ca1b93ff"
PAM_SRC_URI = "file://sshd"
inherit useradd update-rc.d update-alternatives systemd
inherit manpages useradd update-rc.d update-alternatives systemd
USERADD_PACKAGES = "${PN}-sshd"
USERADD_PARAM_${PN}-sshd = "--system --no-create-home --home-dir /var/run/sshd --shell /bin/false --user-group sshd"
@@ -44,6 +43,12 @@ SYSTEMD_SERVICE_${PN}-sshd = "sshd.socket"
inherit autotools-brokensep ptest
PACKAGECONFIG ??= ""
PACKAGECONFIG[kerberos] = "--with-kerberos5,--without-kerberos5,krb5"
PACKAGECONFIG[ldns] = "--with-ldns,--without-ldns,ldns"
PACKAGECONFIG[libedit] = "--with-libedit,--without-libedit,libedit"
PACKAGECONFIG[manpages] = "--with-mantype=man,--with-mantype=cat"
EXTRA_AUTORECONF += "--exclude=aclocal"
# login path is hardcoded in sshd