From nobody Tue Jul 02 16:11:37 2024 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4WD7Fk0Bxrz5MtnX; Tue, 02 Jul 2024 16:11:38 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4WD7Fj6qY2z49Mk; Tue, 2 Jul 2024 16:11:37 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1719936698; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=GMAiqMC4vPQfWDM230Yms0MCUg451UVVL6qKJecOomA=; b=UKEEqaiRW8GHrkxXg37a5Q2KnsWkDD4AovjA+b5nb/r8NfbqpEv/V9KaNZxUHUMyO2QsNu 4xzkL76hOULXp9fXAs42Zlyd8Fear0A/cuaDqRrLr2RCMCZEtkFgCwcVIK+tiXddA6Qy0A 4LMYPbWnOScEprq3LEfY/88YN0orD4ASx10pJyULwbBbnyhDxO6u/4xFSV3/C+nrTf/XWR CdYzHVueRQgTkWH2LQzrtEtCtZVJ2CDl16d9zBxHYWNL4AoylwykEWVPiQfvDfovBzhmdY cAqNb4ynhoCxBl3O16I8GBd5jglAt+EVJJw8d4RSRMC9+1eaRoAc2LlkARbtWQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1719936698; a=rsa-sha256; cv=none; b=l0VntjxrAsJ64p3torix55AcWvRamOrA8OTGaJDHN2sSeQtx94ZTlsQMxa7PUNhguQNJgk Fn7BzR0n6i7VC5ACevGKvq7hwIFWolF8k1CQLsuW74pEHSGmMzCxpXm85n7HPH6JASZTfm weDl/TO9S3MwMf/AmOkPz7X1nx8j+FRylKNYE5lzOaPrckKjNImM+wtcZuV5KN1yKj/cJU wInXpFwpiR5juypwkpRY7iiTJqRxhih+jV/iP/1io+kZp3cS0NRnTDnGpoHNlsxg5qvvS+ KhZA/Otm72hlTy8+jBSLur0D5EE+7WaOZ06WHe7YZEDynRcKaFwp3aIoGjNRyg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1719936698; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=GMAiqMC4vPQfWDM230Yms0MCUg451UVVL6qKJecOomA=; b=D0QiCJed3r9mXewCzsPTbJmKOqVeA0lc3m4fvV3z9XJuMOgBvz3HIpq9KdTbD3TbWBxVVP lBOms8mxnYH52k0cdMbS9QAFUIKpj5p8G+CFDrAFWne41fqc9mj4M5hiF19ueLh14QC3Hw Ay5wb8oiZZkCtYHXwwvqPuQad1qdo9OJURGqErxiha83+HZQzWfLa0BHgc4W+TsJzjmg3a dTq7tI+jHXGEU1M8SS+uz8+j+rUdxBAC23CGta0WRdLc+L17pjnRjVkQzUnm/Rqeqk7u3k KPrvXDw0TiseqlprjCuXq3KD31ye6N3II9YBWAeL/phskacU30pR/HMvnv8LBg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4WD7Fj6RF4ztyT; Tue, 2 Jul 2024 16:11:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 462GBbxF008721; Tue, 2 Jul 2024 16:11:37 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 462GBbJH008718; Tue, 2 Jul 2024 16:11:37 GMT (envelope-from git) Date: Tue, 2 Jul 2024 16:11:37 GMT Message-Id: <202407021611.462GBbJH008718@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-branches@FreeBSD.org From: Bryan Drewery Subject: git: 82c70bd1c2db - 2024Q2 - security/openssh-portable: Bring in patches for recent CVES List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-ports-all@freebsd.org Sender: owner-dev-commits-ports-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bdrewery X-Git-Repository: ports X-Git-Refname: refs/heads/2024Q2 X-Git-Reftype: branch X-Git-Commit: 82c70bd1c2dbe11711390d24b0666cb31f5c4222 Auto-Submitted: auto-generated The branch 2024Q2 has been updated by bdrewery: URL: https://cgit.FreeBSD.org/ports/commit/?id=82c70bd1c2dbe11711390d24b0666cb31f5c4222 commit 82c70bd1c2dbe11711390d24b0666cb31f5c4222 Author: Bryan Drewery AuthorDate: 2024-07-02 16:08:13 +0000 Commit: Bryan Drewery CommitDate: 2024-07-02 16:10:56 +0000 security/openssh-portable: Bring in patches for recent CVES Source: https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html PR: 280068 (cherry picked from commit 7b31ce1eeeb40098b213a153e10530a196b52322) --- security/openssh-portable/Makefile | 2 +- security/openssh-portable/files/patch-9.8-cves | 56 ++++++++++++++++++++++++++ 2 files changed, 57 insertions(+), 1 deletion(-) diff --git a/security/openssh-portable/Makefile b/security/openssh-portable/Makefile index ccf46bb23850..9b1d44580f94 100644 --- a/security/openssh-portable/Makefile +++ b/security/openssh-portable/Makefile @@ -1,6 +1,6 @@ PORTNAME= openssh DISTVERSION= 9.7p1 -PORTREVISION= 0 +PORTREVISION= 2 PORTEPOCH= 1 CATEGORIES= security MASTER_SITES= OPENBSD/OpenSSH/portable diff --git a/security/openssh-portable/files/patch-9.8-cves b/security/openssh-portable/files/patch-9.8-cves new file mode 100644 index 000000000000..2e47d586edcd --- /dev/null +++ b/security/openssh-portable/files/patch-9.8-cves @@ -0,0 +1,56 @@ +https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html + +Damien Miller djm at mindrot.org +Mon Jul 1 18:21:11 AEST 2024 +Previous message (by thread): Announce: OpenSSH 9.8 released +Next message (by thread): Announce: OpenSSH 9.8 released +Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] +Hi, + +Regarding the race condition fixed in OpenSSH 9.8. A mitigation to +prevent exploitation of this bug is to disable the login grace timer +by setting LoginGraceTime=0 in sshd_config. This will however make +it much easier for an attacker to deny service to sshd. + +Similarly, the much more minor keystroke timing bug can be avoided +by disabling the feature using ObscureKeystrokeTiming=0. + +Some users will understandably prefer to patch their OpenSSH rather +than upgrade to the newest version, so here are minimal patches for +both problems. + +1) Critical race condition in sshd + +2) Minor logic error in ObscureKeystrokeTiming + +--- log.c.orig 2024-07-02 09:05:35.023051000 -0700 ++++ log.c 2024-07-02 09:05:54.881067000 -0700 +@@ -451,12 +451,14 @@ sshsigdie(const char *file, const char *func, int line + sshsigdie(const char *file, const char *func, int line, int showfunc, + LogLevel level, const char *suffix, const char *fmt, ...) + { ++#ifdef SYSLOG_R_SAFE_IN_SIGHAND + va_list args; + + va_start(args, fmt); + sshlogv(file, func, line, showfunc, SYSLOG_LEVEL_FATAL, + suffix, fmt, args); + va_end(args); ++#endif + _exit(1); + } + +--- clientloop.c.orig 2024-07-02 09:06:09.736347000 -0700 ++++ clientloop.c 2024-07-02 09:06:41.414979000 -0700 +@@ -608,8 +608,9 @@ obfuscate_keystroke_timing(struct ssh *ssh, struct tim + if (timespeccmp(&now, &chaff_until, >=)) { + /* Stop if there have been no keystrokes for a while */ + stop_reason = "chaff time expired"; +- } else if (timespeccmp(&now, &next_interval, >=)) { +- /* Otherwise if we were due to send, then send chaff */ ++ } else if (timespeccmp(&now, &next_interval, >=) && ++ !ssh_packet_have_data_to_write(ssh)) { ++ /* If due to send but have no data, then send chaff */ + if (send_chaff(ssh)) + nchaff++; + }