buildroot/package/openssh, branch 2017.02

openssh: Move key generation to the start function of init script.

2017-02-26T13:37:54+00:00

Since there's not much point in generating missing host keys when the init script is called with "stop", the call to ssh-keygen should not be done inconditionally, but in the start function instead. Signed-off-by: Ignacy Gawędzki Acked-by: "Yann E. MORIN" Signed-off-by: Thomas Petazzoni

packages: improve license type lists

2017-02-20T21:16:01+00:00

Make license type lists more uniform: * put content license applies to in parenthesis; ex: "GPLv2+ (programs)" * use commas to separate types listed without conjuction; ex: "GPLv2, LGPLv2" No attempt was made to validate the claimed licenses. This is just a tweak to increase uniformity of the _LICENSE variables. Signed-off-by: Danomi Manchego Reviewed-by: Thomas Petazzoni [Thomas: replace semi-colons by commas in LIBURCU_LICENSE.] Signed-off-by: Thomas Petazzoni

openssh: security bump to version 7.4p1

2016-12-19T19:53:24+00:00

Fixes: CVE-2016-10009 - ssh-agent(1): Will now refuse to load PKCS#11 modules from paths outside a trusted whitelist CVE-2016-10010 - sshd(8): When privilege separation is disabled, forwarded Unix-domain sockets would be created by sshd(8) with the privileges of 'root' CVE-2016-10011 - sshd(8): Avoid theoretical leak of host private key material to privilege-separated child processes via realloc() CVE-2016-10012 - sshd(8): The shared memory manager used by pre-authentication compression support had a bounds checks that could be elided by some optimising compilers http://seclists.org/oss-sec/2016/q4/708 Drop upstream patch. Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

openssh: add upstream security fix

2016-11-15T11:58:20+00:00

Fixes CVE-2016-8858: Memory exhaustion, up to 128MB, of unauthenticated peer. Signed-off-by: Baruch Siach Signed-off-by: Thomas Petazzoni

openssh: bump version to 7.3p1

2016-08-01T20:11:31+00:00

Signed-off-by: Vicente Olivert Riera Signed-off-by: Thomas Petazzoni

toolchain: add hidden symbol for PIE support

2016-07-24T19:44:22+00:00

uClibc-ng does not support PIE for some architectures as arc and m68k. It isn't implemented in the static linking case, too. With musl toolchains you might have static PIE support with little patching of gcc. Static linking for GNU libc isn't enabled in buildroot. Fixup any package using special treatment of PIE. (grep -ir pie package/*/*.mk) Signed-off-by: Waldemar Brodkorb [Thomas: use positive logic.] Signed-off-by: Thomas Petazzoni

openssh: security bump to version 7.2p2

2016-03-10T19:49:57+00:00

Fixes: CVE-2016-3115 - sanitise X11 authentication credentials to avoid xauth command injection when X11Forwarding is enabled. Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

openssh: bump to version 7.2p1

2016-02-29T20:45:32+00:00

Signed-off-by: Gustavo Zacarias Signed-off-by: Thomas Petazzoni

openssh: security bump to version 7.1p2

2016-01-14T19:13:57+00:00

Fixes: CVE-2016-0777 - Client Information leak from use of roaming connection feature. CVE-2016-0778 - A buffer overflow flaw was found in the way the OpenSSH client roaming feature was implemented. A malicious server could potentially use this flaw to execute arbitrary code on a successfully authenticated OpenSSH client if that client used certain non-default configuration options. Signed-off-by: Gustavo Zacarias Reviewed-by: James Knight Tested-by: James Knight Signed-off-by: Peter Korsgaard

package: Replace 'echo -n' by 'printf'

2015-10-03T22:56:41+00:00

'echo -n' is not a POSIX construct (no flag support), we shoud use 'printf', especially in init script. This patch was generated by the following command line: git grep -l 'echo -n' -- `git ls-files | grep -v 'patch'` | xargs sed -i 's/echo -n/printf/' Signed-off-by: Maxime Hadjinlian Reviewed-by: Arnout Vandecappelle (Essensium/Mind) Signed-off-by: Peter Korsgaard