gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #335261 from LeSuisse/openssh-gssapi-9.8

Browse Source 
openssh_gssapi: 9.7p1 -> 9.8p1
This commit is contained in:
Robert Scott
2024-08-18 19:52:28 +01:00
committed by GitHub
parent b2fbbdb466 68c2966218
commit 396ac51f7e
3 changed files with 3 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/tools/networking/openssh/default.nix
+3 -5
View File
@@ -58,23 +58,21 @@ in
openssh_gssapi = common rec {
pname = "openssh-with-gssapi";
version = "9.7p1";
version = "9.8p1";
extraDesc = " with GSSAPI support";
src = fetchurl {
url = "mirror://openbsd/OpenSSH/portable/openssh-${version}.tar.gz";
hash = "sha256-SQQm92bYKidj/KzY2D6j1weYdQx70q/y5X3FZg93P/0=";
hash = "sha256-3YvQAqN5tdSZ37BQ3R+pr4Ap6ARh9LtsUjxJlz9aOfM=";
};
extraPatches = [
./ssh-keysign-8.5.patch
./openssh-9.6_p1-CVE-2024-6387.patch
./openssh-9.6_p1-chaff-logic.patch
(fetchpatch {
name = "openssh-gssapi.patch";
url = "https://salsa.debian.org/ssh-team/openssh/raw/debian/1%25${version}-3/debian/patches/gssapi.patch";
hash = "sha256-/lEbH5sIS+o+DStEDAghFy43nZlvcIXSFJrnvp+fDdY=";
hash = "sha256-BnmEZ5pMIbbysesMSm54ykdweH4JudM9D4Pn5uWf3EY=";
})
];
pkgs/tools/networking/openssh/openssh-9.6_p1-CVE-2024-6387.patch
-19
View File
@@ -1,19 +0,0 @@
https://bugs.gentoo.org/935271
Backport proposed by upstream at https://marc.info/?l=oss-security&m=171982317624594&w=2.
--- a/log.c
+++ b/log.c
@@ -451,12 +451,14 @@ void
sshsigdie(const char *file, const char *func, int line, int showfunc,
LogLevel level, const char *suffix, const char *fmt, ...)
{
+#ifdef SYSLOG_R_SAFE_IN_SIGHAND
va_list args;
va_start(args, fmt);
sshlogv(file, func, line, showfunc, SYSLOG_LEVEL_FATAL,
suffix, fmt, args);
va_end(args);
+#endif
_exit(1);
}
pkgs/tools/networking/openssh/openssh-9.6_p1-chaff-logic.patch
-16
View File
@@ -1,16 +0,0 @@
"Minor logic error in ObscureKeystrokeTiming"
https://marc.info/?l=oss-security&m=171982317624594&w=2
--- a/clientloop.c
+++ b/clientloop.c
@@ -608,8 +608,9 @@ obfuscate_keystroke_timing(struct ssh *ssh, struct timespec *timeout,
if (timespeccmp(&now, &chaff_until, >=)) {
/* Stop if there have been no keystrokes for a while */
stop_reason = "chaff time expired";
- } else if (timespeccmp(&now, &next_interval, >=)) {
- /* Otherwise if we were due to send, then send chaff */
+ } else if (timespeccmp(&now, &next_interval, >=) &&
+ !ssh_packet_have_data_to_write(ssh)) {
+ /* If due to send but have no data, then send chaff */
if (send_chaff(ssh))
nchaff++;
}