From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: [v3 0/2] libssh / libssh2 security updates Date: Wed, 24 Feb 2016 15:57:29 -0500 Message-ID: Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:48621) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aYgV9-0005iQ-Av for guix-devel@gnu.org; Wed, 24 Feb 2016 15:57:40 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aYgV6-0003MR-5e for guix-devel@gnu.org; Wed, 24 Feb 2016 15:57:39 -0500 Received: from out4-smtp.messagingengine.com ([66.111.4.28]:54474) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aYgV5-0003MJ-Vk for guix-devel@gnu.org; Wed, 24 Feb 2016 15:57:36 -0500 Received: from jasmine.lan (c-69-249-5-231.hsd1.pa.comcast.net [69.249.5.231]) by mail.messagingengine.com (Postfix) with ESMTPA id 1612C680143 for ; Wed, 24 Feb 2016 15:57:34 -0500 (EST) List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: guix-devel@gnu.org Here is my 3rd take on fixing CVE-2016-0739 (libssh) and CVE-2016-0787 (libssh2). Changes: I "backported" [0] the libssh upstream patch to the old version of libssh that we must keep around for guile-ssh. I cleaned up the commit messages. I added a comment to the curl package explaining the temporary dependency on the old, vulnerable libssh2-1.4. [0] Debian did the same, applying the patch to libssh-0.6.3 without any changes. We apply it to libssh-0.6.5 without any changes. Leo Famulari (2): gnu: libssh2: Update to 1.7.0 [fixes CVE-2016-0787]. gnu: libssh: Update to 0.7.3 [fixes CVE-2016-0739]. gnu-system.am | 2 +- gnu/packages/curl.scm | 11 ++- .../patches/libssh-0.6.5-CVE-2016-0739.patch | 77 +++++++++++++++++++ gnu/packages/patches/libssh-CVE-2014-0017.patch | 89 ---------------------- gnu/packages/ssh.scm | 50 ++++++++---- 5 files changed, 124 insertions(+), 105 deletions(-) create mode 100644 gnu/packages/patches/libssh-0.6.5-CVE-2016-0739.patch delete mode 100644 gnu/packages/patches/libssh-CVE-2014-0017.patch -- 2.7.1