[Buildroot] [PATCH 1/1] package/openssh: security bump to version 8.6p1

[Buildroot] [PATCH 1/1] package/openssh: security bump to version 8.6p1

[Fabrice Fontaine]

Security
========

 * sshd(8): OpenSSH 8.5 introduced the LogVerbose keyword. When this
   option was enabled with a set of patterns that activated logging
   in code that runs in the low-privilege sandboxed sshd process, the
   log messages were constructed in such a way that printf(3) format
   strings could effectively be specified the low-privilege code.

   An attacker who had sucessfully exploited the low-privilege
   process could use this to escape OpenSSH's sandboxing and attack
   the high-privilege process. Exploitation of this weakness is
   highly unlikely in practice as the LogVerbose option is not
   enabled by default and is typically only used for debugging. No
   vulnerabilities in the low-privilege process are currently known
   to exist.

https://www.openssh.com/txt/release-8.6

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
 package/openssh/openssh.hash | 4 ++--
 package/openssh/openssh.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package/openssh/openssh.hash b/package/openssh/openssh.hash
index c50a49896c..0dcd725de5 100644
--- a/package/openssh/openssh.hash
+++ b/package/openssh/openssh.hash
@@ -1,4 +1,4 @@
-# From https://www.openssh.com/txt/release-8.5 (base64 encoded)
-sha256  f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25  openssh-8.5p1.tar.gz
+# From https://www.openssh.com/txt/release-8.6 (base64 encoded)
+sha256  c3e6e4da1621762c850d03b47eed1e48dff4cc9608ddeb547202a234df8ed7ae  openssh-8.6p1.tar.gz
 # Locally calculated
 sha256  432abf7480fb31473a6706627212913fc70032e3fb71b90fecb28ae26a2d741d  LICENCE
diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk
index 055c024cab..61b2c97cf4 100644
--- a/package/openssh/openssh.mk
+++ b/package/openssh/openssh.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-OPENSSH_VERSION_MAJOR = 8.5
+OPENSSH_VERSION_MAJOR = 8.6
 OPENSSH_VERSION_MINOR = p1
 OPENSSH_VERSION = $(OPENSSH_VERSION_MAJOR)$(OPENSSH_VERSION_MINOR)
 OPENSSH_CPE_ID_VERSION = $(OPENSSH_VERSION_MAJOR)
-- 
2.30.2

[Buildroot] [PATCH 1/1] package/openssh: security bump to version 8.6p1

[Yann E. MORIN]

Fabrice, All,

On 2021-05-15 14:10 +0200, Fabrice Fontaine spake thusly:
> Security
> ========
> 
>  * sshd(8): OpenSSH 8.5 introduced the LogVerbose keyword. When this
>    option was enabled with a set of patterns that activated logging
>    in code that runs in the low-privilege sandboxed sshd process, the
>    log messages were constructed in such a way that printf(3) format
>    strings could effectively be specified the low-privilege code.
> 
>    An attacker who had sucessfully exploited the low-privilege
>    process could use this to escape OpenSSH's sandboxing and attack
>    the high-privilege process. Exploitation of this weakness is
>    highly unlikely in practice as the LogVerbose option is not
>    enabled by default and is typically only used for debugging. No
>    vulnerabilities in the low-privilege process are currently known
>    to exist.
> 
> https://www.openssh.com/txt/release-8.6
> 
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>

Applied to master, thanks.

Regards,
Yann E. MORIN.

> ---
>  package/openssh/openssh.hash | 4 ++--
>  package/openssh/openssh.mk   | 2 +-
>  2 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/package/openssh/openssh.hash b/package/openssh/openssh.hash
> index c50a49896c..0dcd725de5 100644
> --- a/package/openssh/openssh.hash
> +++ b/package/openssh/openssh.hash
> @@ -1,4 +1,4 @@
> -# From https://www.openssh.com/txt/release-8.5 (base64 encoded)
> -sha256  f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25  openssh-8.5p1.tar.gz
> +# From https://www.openssh.com/txt/release-8.6 (base64 encoded)
> +sha256  c3e6e4da1621762c850d03b47eed1e48dff4cc9608ddeb547202a234df8ed7ae  openssh-8.6p1.tar.gz
>  # Locally calculated
>  sha256  432abf7480fb31473a6706627212913fc70032e3fb71b90fecb28ae26a2d741d  LICENCE
> diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk
> index 055c024cab..61b2c97cf4 100644
> --- a/package/openssh/openssh.mk
> +++ b/package/openssh/openssh.mk
> @@ -4,7 +4,7 @@
>  #
>  ################################################################################
>  
> -OPENSSH_VERSION_MAJOR = 8.5
> +OPENSSH_VERSION_MAJOR = 8.6
>  OPENSSH_VERSION_MINOR = p1
>  OPENSSH_VERSION = $(OPENSSH_VERSION_MAJOR)$(OPENSSH_VERSION_MINOR)
>  OPENSSH_CPE_ID_VERSION = $(OPENSSH_VERSION_MAJOR)
> -- 
> 2.30.2
> 
> _______________________________________________
> buildroot mailing list
> buildroot at busybox.net
> http://lists.busybox.net/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'

[Buildroot] [PATCH 1/1] package/openssh: security bump to version 8.6p1

[Peter Korsgaard]

>>>>> "Fabrice" == Fabrice Fontaine <fontaine.fabrice@gmail.com> writes:

 > Security
 > ========

 >  * sshd(8): OpenSSH 8.5 introduced the LogVerbose keyword. When this
 >    option was enabled with a set of patterns that activated logging
 >    in code that runs in the low-privilege sandboxed sshd process, the
 >    log messages were constructed in such a way that printf(3) format
 >    strings could effectively be specified the low-privilege code.

 >    An attacker who had sucessfully exploited the low-privilege
 >    process could use this to escape OpenSSH's sandboxing and attack
 >    the high-privilege process. Exploitation of this weakness is
 >    highly unlikely in practice as the LogVerbose option is not
 >    enabled by default and is typically only used for debugging. No
 >    vulnerabilities in the low-privilege process are currently known
 >    to exist.

 > https://www.openssh.com/txt/release-8.6

 > Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>

Committed to 2021.02.x, thanks.

-- 
Bye, Peter Korsgaard