buildroot/package/openssh, branch 2019.02-op-build

openssh: add upstream security fixes

2019-02-12T18:59:11+00:00

CVE-2019-6109: Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c. CVE-2019-6111: Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). Signed-off-by: Baruch Siach Signed-off-by: Peter Korsgaard

package/openssh: Add sysusers.d snippet

2019-02-06T17:03:51+00:00

Whether using the new sysusers.d snippet, or adding an entry to /etc/password, set the service's home directory to /var/empty. See README.privsep included as part of the openssh distribution. Signed-off-by: Chris Lesiak Signed-off-by: Arnout Vandecappelle (Essensium/Mind)

package/openssh: Set /var/empty permissions

2019-02-03T20:49:20+00:00

The openssh privilege separation feature, enabled by default, requires that the path /var/empty exists and has certain permissions (not writable by the sshd user). Note that nothing ever gets writting in this directory, so it works fine on a readonly rootfs. See README.privsep included as part of the openssh distribution. Signed-off-by: Chris Lesiak Signed-off-by: Arnout Vandecappelle (Essensium/Mind)

package/openssh: add upstream security fix

2019-01-15T18:49:22+00:00

Fixes CVE-2018-20685: The scp client allows server to modify permissions of the target directory by using empty ("D0777 0 \n") or dot ("D0777 0 .\n") directory name. The bug reporter lists a number of related vulnerabilities that are not fixed yet: https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt Signed-off-by: Baruch Siach Signed-off-by: Peter Korsgaard

package/openssh: use BR2_SYSTEM_DEFAULT_PATH as default PATH

2018-12-31T13:33:32+00:00

We use the configuration option $(BR2_SYSTEM_DEFAULT_PATH) to set the default PATH in OpenSSH sessions. $(BR2_SYSTEM_DEFAULT_PATH) is a Kconfig string. So it is already quoted, which is exactly what we want. Signed-off-by: Markus Mayer Reviewed-by: "Yann E. MORIN" Signed-off-by: Thomas Petazzoni

openssh: bump to version 7.9p1

2018-10-21T21:31:12+00:00

Drop patch #1. uClibc no longer includes pthreads.h indirectly. Drop patch #2. The sys/param.h header is included indirectly through the local includes.h header since version 6.8p1. Signed-off-by: Baruch Siach Signed-off-by: Peter Korsgaard

openssh: security bump to version 7.8

2018-08-24T12:38:01+00:00

Fixes CVE-2018-15473: user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed. Some OpenSSH developers don't consider this a security issue: https://lists.mindrot.org/pipermail/openssh-unix-dev/2018-August/037138.html Signed-off-by: Baruch Siach Signed-off-by: Thomas Petazzoni

openssh: bump to version 7.7p1

2018-04-10T07:28:46+00:00

Drop upstream patches, renumber the rest. Signed-off-by: Baruch Siach Signed-off-by: Thomas Petazzoni

package/openssh: also install ssh-copy-id script

2018-02-08T22:10:09+00:00

This script is useful to copy SSH keys between client and server [1] and installed on most distributions (for example on debian: [2]). [1] https://www.ssh.com/ssh/copy-id [2] https://packages.debian.org/fr/jessie/armhf/openssh-client/filelist Signed-off-by: Julien BOIBESSOT Reviewed-by: "Yann E. MORIN" [Thomas: use full destination path.] Signed-off-by: Thomas Petazzoni

package/*/Config.in: fix help text check-package warnings

2017-12-18T08:22:54+00:00

This commit fixes the warnings reported by check-package on the help text of all package Config.in files, related to the formatting of the help text: should start with a tab, then 2 spaces, then at most 62 characters. The vast majority of warnings fixed were caused by too long lines. A few warnings were related to spaces being used instead of a tab to indent the help text. Signed-off-by: Thomas Petazzoni