From nobody Tue Jul 02 16:11:32 2024 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4WD7Fc5t7Mz5Mtd5; Tue, 02 Jul 2024 16:11:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4WD7Fc5Qvsz4967; Tue, 2 Jul 2024 16:11:32 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1719936692; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=2GROqg38O02aTLqQsc+Lz97ekmK65I/AUivHYlQ0P80=; b=TKpqc9z+ed/U0sScNNl48COeLJ8lBE1cBFOS1KpTdX6+4/vqHUzcNcmJ1LgDBd3FhTIWR5 iog/raFiAfisPK7Trk+ZwXBlAB8voVUKRqnQgDQK4qzDCrnyqXpG8/+tELaLetkD3IcWaM LrurC+2pucTRHu4ACgykPdUUYx4Cd+DxOJzxchvc3gb2mCJbwOZ59EHUMk1VnSDREGVZLD H0ndAAJPPc1rM/3Xgh/phvcdrWgx52Ad7c9vj5mydkxhXz63BNkSsvufilFf+ipJ+jBCoF Na4/rWWWVqMkPSLfpf9YbwKdZyQEhWdlsNkOcn4V6Fs7mSgv+yhzMIhT3DG3+A== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1719936692; a=rsa-sha256; cv=none; b=JTV/R6wPBfBSS/HzyqaSXuWYVZmD2zroOzvFHfuq/FkmhCkI4g/lnN+UxDfHo0vq9qZdvG XduS1uy1BJnqfM6p1sA0NS3nBzt8COhzVFDcmFnYsGNMk14k0J1BgghRXqqRVF0IjEUUSx 6GacpD/xJbz6EfMaV8tkgFEntYyvUZiIwM7tZNTUksh06YT/o3uB+oPs2CKnmxwOmlOfBM hJRbnxXd7KbHObgqeeahLRKcfkkbrJ+MUw7l1lw2eR2+xecsHZYTHE9mc7YfBEZfLUPp4p 1FjtGkp7c86GyEmuSpb/dCzGw4N4zWMYEuxj9rA24ScoXG4qVtx1fJYV0AywNw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1719936692; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=2GROqg38O02aTLqQsc+Lz97ekmK65I/AUivHYlQ0P80=; b=JAYfZjFU7cMY8zkEMoiFNesG8XeOM30xZqkV5fHvzR+fRz8au+VDxIftHL/OaG4d8ksVli m6QJOfFgLwwIOEbBERiJD1WHccFQwhJnDH+IogIg+yU5rB3mbBZU3V83Bj0aUcgALMrxOY RpVgDIuSN6Xu73hX92r25fKtkHf1zlUVe94kV7L5FrjONMjVffIlxHiTQIWbUpKxTc6bCq JQwoOOnp9VREr7No0NFjknfP/3PY6ReNi5HIthTfEWK2J5giYhe8hjnI16p634YUHd173e 9bcUHKy1JIhj730B5We1k6X8+zdA/Cza8yPPwg5WL3zPI0gMwOv5OXTCTVdzoA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4WD7Fc4pxbztq8; Tue, 2 Jul 2024 16:11:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 462GBW8H008560; Tue, 2 Jul 2024 16:11:32 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 462GBWOL008557; Tue, 2 Jul 2024 16:11:32 GMT (envelope-from git) Date: Tue, 2 Jul 2024 16:11:32 GMT Message-Id: <202407021611.462GBWOL008557@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Bryan Drewery Subject: git: 7b31ce1eeeb4 - main - security/openssh-portable: Bring in patches for recent CVES List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-ports-all@freebsd.org Sender: owner-dev-commits-ports-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bdrewery X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 7b31ce1eeeb40098b213a153e10530a196b52322 Auto-Submitted: auto-generated The branch main has been updated by bdrewery: URL: https://cgit.FreeBSD.org/ports/commit/?id=7b31ce1eeeb40098b213a153e10530a196b52322 commit 7b31ce1eeeb40098b213a153e10530a196b52322 Author: Bryan Drewery AuthorDate: 2024-07-02 16:08:13 +0000 Commit: Bryan Drewery CommitDate: 2024-07-02 16:08:13 +0000 security/openssh-portable: Bring in patches for recent CVES Source: https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html PR: 280068 --- security/openssh-portable/Makefile | 2 +- security/openssh-portable/files/patch-9.8-cves | 56 ++++++++++++++++++++++++++ 2 files changed, 57 insertions(+), 1 deletion(-) diff --git a/security/openssh-portable/Makefile b/security/openssh-portable/Makefile index 5cf4aa38d3e3..9b1d44580f94 100644 --- a/security/openssh-portable/Makefile +++ b/security/openssh-portable/Makefile @@ -1,6 +1,6 @@ PORTNAME= openssh DISTVERSION= 9.7p1 -PORTREVISION= 1 +PORTREVISION= 2 PORTEPOCH= 1 CATEGORIES= security MASTER_SITES= OPENBSD/OpenSSH/portable diff --git a/security/openssh-portable/files/patch-9.8-cves b/security/openssh-portable/files/patch-9.8-cves new file mode 100644 index 000000000000..2e47d586edcd --- /dev/null +++ b/security/openssh-portable/files/patch-9.8-cves @@ -0,0 +1,56 @@ +https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html + +Damien Miller djm at mindrot.org +Mon Jul 1 18:21:11 AEST 2024 +Previous message (by thread): Announce: OpenSSH 9.8 released +Next message (by thread): Announce: OpenSSH 9.8 released +Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] +Hi, + +Regarding the race condition fixed in OpenSSH 9.8. A mitigation to +prevent exploitation of this bug is to disable the login grace timer +by setting LoginGraceTime=0 in sshd_config. This will however make +it much easier for an attacker to deny service to sshd. + +Similarly, the much more minor keystroke timing bug can be avoided +by disabling the feature using ObscureKeystrokeTiming=0. + +Some users will understandably prefer to patch their OpenSSH rather +than upgrade to the newest version, so here are minimal patches for +both problems. + +1) Critical race condition in sshd + +2) Minor logic error in ObscureKeystrokeTiming + +--- log.c.orig 2024-07-02 09:05:35.023051000 -0700 ++++ log.c 2024-07-02 09:05:54.881067000 -0700 +@@ -451,12 +451,14 @@ sshsigdie(const char *file, const char *func, int line + sshsigdie(const char *file, const char *func, int line, int showfunc, + LogLevel level, const char *suffix, const char *fmt, ...) + { ++#ifdef SYSLOG_R_SAFE_IN_SIGHAND + va_list args; + + va_start(args, fmt); + sshlogv(file, func, line, showfunc, SYSLOG_LEVEL_FATAL, + suffix, fmt, args); + va_end(args); ++#endif + _exit(1); + } + +--- clientloop.c.orig 2024-07-02 09:06:09.736347000 -0700 ++++ clientloop.c 2024-07-02 09:06:41.414979000 -0700 +@@ -608,8 +608,9 @@ obfuscate_keystroke_timing(struct ssh *ssh, struct tim + if (timespeccmp(&now, &chaff_until, >=)) { + /* Stop if there have been no keystrokes for a while */ + stop_reason = "chaff time expired"; +- } else if (timespeccmp(&now, &next_interval, >=)) { +- /* Otherwise if we were due to send, then send chaff */ ++ } else if (timespeccmp(&now, &next_interval, >=) && ++ !ssh_packet_have_data_to_write(ssh)) { ++ /* If due to send but have no data, then send chaff */ + if (send_chaff(ssh)) + nchaff++; + }