From afff53db2a3b8da2df89f4ba28a02f25e3b93a3f Mon Sep 17 00:00:00 2001 From: Haris Okanovic Date: Fri, 30 Oct 2015 15:12:56 -0500 Subject: openssh: Backport CVE-2015-5600 fix only query each keyboard-interactive device once per authentication request regardless of how many times it is listed Source: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth2-chall.c?f=h#rev1.43 http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth2-chall.c.diff?r2=1.43&r1=1.42&f=u Bug report: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5600 https://bugzilla.redhat.com/show_bug.cgi?id=1245969 Testing: Built in Fido and installed to x86_64 test system. Verified both 'keyboard-interactive' and 'publickey' logon works with root and a regular user from an openssh 7.1p1-1 client on Arch. (From OE-Core rev: 433f66ba6c79cf49e29251af0985baf5c4b79e23) Signed-off-by: Haris Okanovic Reviewed-by: Rich Tollerton Reviewed-by: Ken Sharp Natinst-ReviewBoard-ID: 115602 Natinst-CAR-ID: 541263 Signed-off-by: Joshua Lock Signed-off-by: Richard Purdie --- meta/recipes-connectivity/openssh/openssh_6.7p1.bb | 1 + 1 file changed, 1 insertion(+) (limited to 'meta/recipes-connectivity/openssh/openssh_6.7p1.bb') diff --git a/meta/recipes-connectivity/openssh/openssh_6.7p1.bb b/meta/recipes-connectivity/openssh/openssh_6.7p1.bb index aa71cc1ef4..9246284d14 100644 --- a/meta/recipes-connectivity/openssh/openssh_6.7p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_6.7p1.bb @@ -25,6 +25,7 @@ SRC_URI = "ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar. file://CVE-2015-6563.patch \ file://CVE-2015-6564.patch \ file://CVE-2015-6565.patch \ + file://CVE-2015-5600.patch \ " PAM_SRC_URI = "file://sshd" -- cgit v1.2.3-54-g00ecf