From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: Re: [PATCH 1/1] gnu: openssh: Fix CVE-2015-8325. Date: Fri, 15 Apr 2016 17:47:09 -0400 Message-ID: <20160415214709.GA11506@jasmine> References: <7eee4d808f7cc2b35eb7ae45c86079ba68a9e55d.1460744429.git.leo@famulari.name> <87r3e6r29k.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:55023) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1arBZh-0008UG-Ur for guix-devel@gnu.org; Fri, 15 Apr 2016 17:46:50 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1arBZe-0001jv-Kd for guix-devel@gnu.org; Fri, 15 Apr 2016 17:46:49 -0400 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:35977) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1arBZe-0001jq-G6 for guix-devel@gnu.org; Fri, 15 Apr 2016 17:46:46 -0400 Received: from compute3.internal (compute3.nyi.internal [10.202.2.43]) by mailout.nyi.internal (Postfix) with ESMTP id D090E20D19 for ; Fri, 15 Apr 2016 17:46:45 -0400 (EDT) Content-Disposition: inline In-Reply-To: <87r3e6r29k.fsf@gnu.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Ludovic =?iso-8859-1?Q?Court=E8s?= Cc: guix-devel@gnu.org On Fri, Apr 15, 2016 at 11:27:35PM +0200, Ludovic Courtès wrote: > Leo Famulari skribis: > > > * gnu/packages/patches/openssh-CVE-2015-8325.patch: New file. > > * gnu-system.am (dist_patch_DATA): Add it. > > * gnu/packages/ssh.scm (openssh): Use it. > > The explanation in the OpenSSH commit log is clear IMO and the fix looks > reasonable, so I’d say go for it… > > … but I can’t seem to find the change in the authoritative repo: > > http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/session.c The web page for the portable version of OpenSSH [0] (which is what we package) says this: "Normal OpenSSH development produces a very small, secure, and easy to maintain version for the OpenBSD project. The OpenSSH Portability Team takes that pure version and adds portability code so that OpenSSH can run on many other operating systems (Unfortunately, in particular since OpenSSH does authentication, it runs into a *lot* of differences between Unix operating systems)." The bug is related to how sshd interacts with PAM. My understanding is that OpenBSD does not use PAM, so the bug would not exist in their repository. [0] FYI, I could not load this site over HTTPS http://www.openssh.com/portable.html This page also links to the repository that contains the patch.