lp:ubuntu/dapper-updates/openssh

Branch merges

Propose for merging

No branches dependent on this one.

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Related blueprints

14. By Kees Cook on 2008-09-29

* SECURITY UPDATE: block signal handler crash DoS.
* log.c: backport upstream corrections, thanks to Florian Weimer.
* References
  CVE-2008-4109

13. By Colin Watson on 2008-05-17

* Mitigate OpenSSL security vulnerability (CVE-2008-0166):
  - Add key blacklisting support. Keys listed in
    /etc/ssh/blacklist.TYPE-LENGTH will be rejected for authentication by
    sshd, unless "PermitBlacklistedKeys yes" is set in
    /etc/ssh/sshd_config.
  - Add a new program, ssh-vulnkey, which can be used to check keys
    against these blacklists.
  - Depend on openssh-blacklist.

12. By Kees Cook on 2008-04-01

* SECURITY UPDATE: X11 forward hijacking via alternate address families.
* channels.c: upstream fixes, patched inline. Thanks to Nicolas Valcarcel
  (LP: #210175).
* References
  CVE-2008-1483

11. By Kees Cook on 2008-01-09

* SECURITY UPDATE: trusted cookie leak when untrusted cookie cannot be
  generated.
* clientloop.c: Applied patch according to openssh upstream (LP: #162171),
  thanks to Stephan Hermann.
* References:
  CVE-2007-4752
  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=444738
  http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/clientloop.c.diff?r1=1.180&r2=1.181

10. By Martin Pitt on 2006-10-02

* SECURITY UPDATE: Remote DoS.
* CVE-2006-4924: Fix a pre-authentication denial of service found by
  Tavis Ormandy, that would cause sshd(8) to spin until the login grace
  time expired.
  Upstream fixes:
  http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/deattack.c.diff?r1=1.29&r2=1.30&sortby=date&f=h
  http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/packet.c.diff?r1=1.143&r2=1.144&sortby=date&f=h
  http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/deattack.h.diff?r1=1.9&r2=1.10&sortby=date&f=h
* Fix an unsafe signal hander reported by Mark Dowd. The
  signal handler was vulnerable to a race condition that could be
  exploited to perform a pre-authentication denial of service. [CVE-2006-5051]
  On portable OpenSSH, this vulnerability could theoretically lead to
  pre-authentication remote code execution if GSSAPI authentication is
  enabled, but the likelihood of successful exploitation appears remote.
  [CVE-2006-5052]
* Above patches taken from Debian's 4.3p2-4 version, thanks to Colin Watson
  for backporting them from 4.4p1.
* packet.c: Fix a NULL dereference crash so that an appropriate error
  message is printed on a protocol error. This is not actually a
  vulnerability, but has been assigned CVE-2006-4925, so let's fix it for
  completeness' sake.
  Taken from upstream CVS:
  http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/packet.c.diff?sortby=date&r2=1.145&r1=1.144&f=h

9. By Colin Watson on 2006-05-17

On '/etc/init.d/ssh restart', create /var/run/sshd before checking the
server configuration, as otherwise 'sshd -t' will complain about the
lack of /var/run/sshd (closes: Malone #45234).

8. By Colin Watson on 2006-05-12

* Backport from OpenSSH 4.3 (closes: Malone #25528):
  - Set SO_REUSEADDR on X11 listeners to avoid problems caused by
    lingering sockets from previous session (X11 applications can
    sometimes not connect to 127.0.0.1:60xx).

7. By Colin Watson on 2006-03-01

Resynchronise with Debian.

6. By Martin Pitt on 2006-02-20

* SECURITY UPDATE: Shell code injection with crafted file names in scp.
* Ported upstream patch from 4.3p2 to replace system() call with a proper
  exec() call; this avoids expanding shell metacharacters in local-to-local
  or remote-to-remote copies.
* CVE-2006-0225

5. By Colin Watson on 2005-10-31

Resynchronise with Debian.