summaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity/openssh
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-connectivity/openssh')
-rw-r--r--meta/recipes-connectivity/openssh/openssh/0001-upstream-fix-integer-overflow-in-XMSS-private-key-pa.patch40
-rw-r--r--meta/recipes-connectivity/openssh/openssh_8.0p1.bb1
2 files changed, 41 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/openssh/openssh/0001-upstream-fix-integer-overflow-in-XMSS-private-key-pa.patch b/meta/recipes-connectivity/openssh/openssh/0001-upstream-fix-integer-overflow-in-XMSS-private-key-pa.patch
new file mode 100644
index 0000000000..3265be3485
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/0001-upstream-fix-integer-overflow-in-XMSS-private-key-pa.patch
@@ -0,0 +1,40 @@
1From 2014fad3d28090b59d2f8a0971166c06e5fa6da6 Mon Sep 17 00:00:00 2001
2From: Hongxu Jia <hongxu.jia@windriver.com>
3Date: Fri, 18 Oct 2019 14:56:58 +0800
4Subject: [PATCH] upstream: fix integer overflow in XMSS private key parsing.
5
6Reported by Adam Zabrocki via SecuriTeam's SSH program.
7
8Note that this code is experimental and not compiled by default.
9
10ok markus@
11
12OpenBSD-Commit-ID: cd0361896d15e8a1bac495ac583ff065ffca2be1
13
14Signed-off-by: "djm@openbsd.org" <djm@openbsd.org>
15
16Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/a546b17bbaeb12beac4c9aeed56f74a42b18a93a]
17CVE: CVE-2019-16905
18
19Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
20---
21 sshkey-xmss.c | 3 ++-
22 1 file changed, 2 insertions(+), 1 deletion(-)
23
24diff --git a/sshkey-xmss.c b/sshkey-xmss.c
25index aaae702..c57681a 100644
26--- a/sshkey-xmss.c
27+++ b/sshkey-xmss.c
28@@ -977,7 +977,8 @@ sshkey_xmss_decrypt_state(const struct sshkey *k, struct sshbuf *encoded,
29 goto out;
30 }
31 /* check that an appropriate amount of auth data is present */
32- if (sshbuf_len(encoded) < encrypted_len + authlen) {
33+ if (sshbuf_len(encoded) < authlen ||
34+ sshbuf_len(encoded) - authlen < encrypted_len) {
35 r = SSH_ERR_INVALID_FORMAT;
36 goto out;
37 }
38--
392.7.4
40
diff --git a/meta/recipes-connectivity/openssh/openssh_8.0p1.bb b/meta/recipes-connectivity/openssh/openssh_8.0p1.bb
index 01eaecd4ec..2ffbc9a95f 100644
--- a/meta/recipes-connectivity/openssh/openssh_8.0p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_8.0p1.bb
@@ -24,6 +24,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
24 file://fix-potential-signed-overflow-in-pointer-arithmatic.patch \ 24 file://fix-potential-signed-overflow-in-pointer-arithmatic.patch \
25 file://sshd_check_keys \ 25 file://sshd_check_keys \
26 file://add-test-support-for-busybox.patch \ 26 file://add-test-support-for-busybox.patch \
27 file://0001-upstream-fix-integer-overflow-in-XMSS-private-key-pa.patch \
27 " 28 "
28SRC_URI[md5sum] = "bf050f002fe510e1daecd39044e1122d" 29SRC_URI[md5sum] = "bf050f002fe510e1daecd39044e1122d"
29SRC_URI[sha256sum] = "bd943879e69498e8031eb6b7f44d08cdc37d59a7ab689aa0b437320c3481fd68" 30SRC_URI[sha256sum] = "bd943879e69498e8031eb6b7f44d08cdc37d59a7ab689aa0b437320c3481fd68"