[PATCH] gnu: libssh2: Update to 1.8.1 with a graft [security fixes].

  • Done
  • quality assurance status badge
Details
2 participants
  • Efraim Flashner
  • Leo Famulari
Owner
unassigned
Submitted by
Leo Famulari
Severity
normal
L
L
Leo Famulari wrote on 20 Mar 2019 21:31
(address . guix-patches@gnu.org)
128204645081af4cc1e10f5aef21b9b4e6dc9d81.1553113916.git.leo@famulari.name
Fixes CVE-2019-{3855,3856,3857,3858,3859,3860,3861,3862,3863}.
---
gnu/packages/ssh.scm | 16 ++++++++++++++++
1 file changed, 16 insertions(+)

Toggle diff (36 lines)
diff --git a/gnu/packages/ssh.scm b/gnu/packages/ssh.scm
index dc81736f06..ec81844b93 100644
--- a/gnu/packages/ssh.scm
+++ b/gnu/packages/ssh.scm
@@ -111,6 +111,7 @@ applications.")
(define-public libssh2
(package
(name "libssh2")
+ (replacement libssh2-1.8.1)
(version "1.8.0")
(source (origin
(method url-fetch)
@@ -143,6 +144,21 @@ a server that supports the SSH-2 protocol.")
(license license:bsd-3)
(home-page "https://www.libssh2.org/")))
+(define-public libssh2-1.8.1
+ (package
+ (inherit libssh2)
+ (version "1.8.1")
+ (source (origin
+ (method url-fetch)
+ (uri (string-append
+ "https://www.libssh2.org/download/libssh2-"
+ version ".tar.gz"))
+ (sha256
+ (base32
+ "0ngif3ynk6xqzy5nlfjs7bsmfm81g9f145av0z86kf0vbgrigda0"))
+ (patches
+ (search-patches "libssh2-fix-build-failure-with-gcrypt.patch"))))))
+
(define-public openssh
(package
(name "openssh")
--
2.21.0
E
E
Efraim Flashner wrote on 20 Mar 2019 21:35
(name . Leo Famulari)(address . leo@famulari.name)(address . 34926@debbugs.gnu.org)
20190320203504.GA3879@macbook41
Is the patch already in the repo or did you forget to attach it?


--
Efraim Flashner <efraim@flashner.co.il> ????? ?????
GPG key = A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEoov0DD5VE3JmLRT3Qarn3Mo9g1EFAlySo/MACgkQQarn3Mo9
g1FTExAAu3VrBD4HDylXzUXs7nKWfSkfMm5NgSNLbop9m88fOWsk5e4laANfPRXX
ArKj+Lik8LCKHUL59ZAo94xPUCtW5ERSCEGXEj7gHq9iXQOsDhmfzzpi4zeOcpN8
Am7ypgxn0cJja9OiBCzaGtzkSt9KnfrJtPZbpO+lsbWuy8PS65PTRkcm9lH26lCb
XNV4j0kHS+acF5Wn8DPkDJCBT6KvibNGQHKuFhzqTWNRlOhwNktk916kv1am8bmS
KR/2UKSQUW3DUflxjeVRNab/NbYdRUWwimHafts7hWe5NBx+1u/kkpc50WkqgceA
xkkn9L55VtVIvaLv3WxYT42IvqOE2AI1AVJKUQhB9z+OybEnqkKpA0I6fkk0SIqD
8k1V08hbnhyZ2aDiDT8+r5pIqE/ls8PBAcmIREMKt3/sXFBv2SC36ktjnUokI4Hi
ph9XezDtGPsJba8drS4ntJHoTq1fwSvTCq/6P0k6geIYnPmrgJ3ZViBe70IiZcr7
ubBCA1yzHX+JN9yb9YWZYMQn9SrJRnSMcYyZZk/cnAcQdcaP91P9S38LwzMyBEzQ
cOwPfir34HfYi147rzjiWInpAbn/xTie+HT+8Gu1Gwu/aBnH/UQWaepZhNB6RvHN
73XVdVNqXW7nacvuXVeO3uEmY7ph7tTJxXzXdjhMWvDMxdCPMv8=
=KAY5
-----END PGP SIGNATURE-----


L
L
Leo Famulari wrote on 20 Mar 2019 21:42
(no subject)
(address . control@debbugs.gnu.org)
20190320204246.GA21432@jasmine.lan
tags 34926 security patch
L
L
Leo Famulari wrote on 20 Mar 2019 21:43
Re: [bug#34926] [PATCH] gnu: libssh2: Update to 1.8.1 with a graft [security fixes].
(name . Efraim Flashner)(address . efraim@flashner.co.il)(address . 34926@debbugs.gnu.org)
20190320204348.GB21181@jasmine.lan
On Wed, Mar 20, 2019 at 10:35:04PM +0200, Efraim Flashner wrote:
Toggle quote (2 lines)
> Is the patch already in the repo or did you forget to attach it?

I'm not sure what happened but I did sent it with `git send-email`:

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlySpgQACgkQJkb6MLrK
fwjSuRAA3G+nhOD9iMbSUUOTYPECJP87Kcpw+P5VQWmGi73rwNoR63qdblhnuvSg
knM/M9SpiNZ3pQ8Y3PQyuZL4zx24RTlF77taj8P5iMsFpl1oC4ocU+1GS+T1+PZF
ToUs7IJWYPi+1ybeCciQAK0AHqlcdrVTGKWH6tdDp1rYQk/Df4ecY1uj+5Ztgyja
Yf+2npXMQOpC3t4zYjsVkgbZp/Up+rLHLMoxA9JBcPS8iw4ecxGWIIy6e/8GZnsI
Uz9H4Q75zQ+YEtbMy5Xv4muhtt/1s29MgOCpfF8tWGhYTDfovd2DfTpglwlEn6cG
F3F9DnFp/PuD9kysdsW4qz+QH4/VGA8O2Kkljo2hQvCD+Q2/prFUgR9tmX6aBABQ
yIOUYn76r4b++GaMbAH4ghIZIpgpEpmqKwpwh4jklelEP3xh16m49IqlJnbwMhc6
cCoLj+zqWvXCnAtpcJD8o+zvdHTRdUnZDGdbFyU+bVtwb/O87GTRERoH3iZleYuP
go+uFzD1X+YszJ1dbBJkg2PXUGHQk01bWuM2StK4aNfEsFH3yPUOK9rU7gOkoaOr
im2LNDuC7ef1DZd3jlVTQuGUFWOrPP61O1YdQAn0sJRsW3hp30gUUKweKtvSIFld
7ERsLA2VEKHRordpigFtrOT0kctFAujEyIcxeqMkMGALiWxGsIU=
=0Fi8
-----END PGP SIGNATURE-----


L
L
Leo Famulari wrote on 21 Mar 2019 18:38
(name . Efraim Flashner)(address . efraim@flashner.co.il)(address . 34926-done@debbugs.gnu.org)
20190321173851.GA14834@jasmine.lan
I've pushed a variant of this patch as
af8f7eb4f2a664c2d0fb3faabaf2e80c72993ef6
-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlyTzCsACgkQJkb6MLrK
fwjIjQ/9GrwofOgRTEvT6TjzXn3STDcvrs1Z41Q++7M2EM7EdbHTbImoTzlc08Q/
4jHym+kXUHrAKznE1bYRFtNimjaG9aIFao17NYb2lBMUq0Pfu0geVQMzXTVUSWdn
yQWvfzVDemJDXhandAgKsSMuMMrGTF2iBUsDMkT2RaxiXe4Z6Hy1ntD6uJwX8Uu1
CDoiTf8PoEiq2j7CZ4a8YZtR86VqpKjQnoeqAzlLEzJiLopce6hC+bVRFvpaCGIg
erpNlp0UqWTl8Et/QeCXfD+kdgU+w5A3T4TmmeXWWC1VUIXXMTQceEd4xZkzElNV
vwFGsXvHHoViKUL9Xxdm4WYg5ihU6OJFX/LqG/6PSduudsVxl/iVgddIw+bZEYU+
PUM1orBC6DedyYn9resiw3wz22EQ/avWSjZwPvyOn3q/6t/1ybs8S4Pb/0fIwdWE
R1VqUlIE5kSfT5/KpWL7oo3QCUlNGhldDl/98Vm3Z+rc/DcXKHG4iZwoRKLXU4tZ
be2jIY1N42wqJbIFjKZAGVxdc85xhVM+yY0wC/EoKxQLoItlNrxPNtIyiH7sPvnL
Ud4Oym9Lp1hcy0YH1864eqonfNfvQOjUBQdJ7GiqKJhn7UxlyHLlhh3/US/IHG8v
b1+A2AWBOR3uVoEi0nov3+5h5vxIQGPszKbfwCbaOPH4pKd07y4=
=sNlf
-----END PGP SIGNATURE-----


Closed
?