buildroot/package/openssh, branch 2016.11.1

openssh: security bump to version 7.4p1

2016-12-19T22:14:28+00:00

Fixes: CVE-2016-10009 - ssh-agent(1): Will now refuse to load PKCS#11 modules from paths outside a trusted whitelist CVE-2016-10010 - sshd(8): When privilege separation is disabled, forwarded Unix-domain sockets would be created by sshd(8) with the privileges of 'root' CVE-2016-10011 - sshd(8): Avoid theoretical leak of host private key material to privilege-separated child processes via realloc() CVE-2016-10012 - sshd(8): The shared memory manager used by pre-authentication compression support had a bounds checks that could be elided by some optimising compilers http://seclists.org/oss-sec/2016/q4/708 Drop upstream patch. Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard (cherry picked from commit ae58da71111c9a9825fa8dab1338831ff38dc320)

openssh: add upstream security fix

2016-11-15T11:58:20+00:00

Fixes CVE-2016-8858: Memory exhaustion, up to 128MB, of unauthenticated peer. Signed-off-by: Baruch Siach Signed-off-by: Thomas Petazzoni

openssh: bump version to 7.3p1

2016-08-01T20:11:31+00:00

Signed-off-by: Vicente Olivert Riera Signed-off-by: Thomas Petazzoni

toolchain: add hidden symbol for PIE support

2016-07-24T19:44:22+00:00

uClibc-ng does not support PIE for some architectures as arc and m68k. It isn't implemented in the static linking case, too. With musl toolchains you might have static PIE support with little patching of gcc. Static linking for GNU libc isn't enabled in buildroot. Fixup any package using special treatment of PIE. (grep -ir pie package/*/*.mk) Signed-off-by: Waldemar Brodkorb [Thomas: use positive logic.] Signed-off-by: Thomas Petazzoni

openssh: security bump to version 7.2p2

2016-03-10T19:49:57+00:00

Fixes: CVE-2016-3115 - sanitise X11 authentication credentials to avoid xauth command injection when X11Forwarding is enabled. Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

openssh: bump to version 7.2p1

2016-02-29T20:45:32+00:00

Signed-off-by: Gustavo Zacarias Signed-off-by: Thomas Petazzoni

openssh: security bump to version 7.1p2

2016-01-14T19:13:57+00:00

Fixes: CVE-2016-0777 - Client Information leak from use of roaming connection feature. CVE-2016-0778 - A buffer overflow flaw was found in the way the OpenSSH client roaming feature was implemented. A malicious server could potentially use this flaw to execute arbitrary code on a successfully authenticated OpenSSH client if that client used certain non-default configuration options. Signed-off-by: Gustavo Zacarias Reviewed-by: James Knight Tested-by: James Knight Signed-off-by: Peter Korsgaard

package: Replace 'echo -n' by 'printf'

2015-10-03T22:56:41+00:00

'echo -n' is not a POSIX construct (no flag support), we shoud use 'printf', especially in init script. This patch was generated by the following command line: git grep -l 'echo -n' -- `git ls-files | grep -v 'patch'` | xargs sed -i 's/echo -n/printf/' Signed-off-by: Maxime Hadjinlian Reviewed-by: Arnout Vandecappelle (Essensium/Mind) Signed-off-by: Peter Korsgaard

openssh: fix static compilation

2015-08-29T08:43:52+00:00

PIE and static doesn't work on Linux. Fixes: http://autobuild.buildroot.net/results/dce/dce0202e039f4636d68532c4aab8738938b76650/ Signed-off-by: Waldemar Brodkorb Signed-off-by: Thomas Petazzoni

openssh: security bump to version 7.1p1

2015-08-25T20:41:08+00:00

Fixes: CVE-2015-6563 - Fixed a privilege separation weakness related to PAM support. CVE-2015-6564 - Fixed a use-after-free bug related to PAM support that was reachable by attackers who could compromise the pre-authentication process for remote code exectuion. CVE-2015-6565 - incorrectly set TTYs to be world-writable. Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard