commit libssh2_org.5004 for openSUSE:13.2:Update

Hello community, here is the log from the commit of package libssh2_org.5004 for openSUSE:13.2:Update checked in at 2016-04-29 10:35:25 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:13.2:Update/libssh2_org.5004 (Old) and /work/SRC/openSUSE:13.2:Update/.libssh2_org.5004.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "libssh2_org.5004" Changes: -------- New Changes file: --- /dev/null 2016-04-07 01:36:33.300037506 +0200 +++ /work/SRC/openSUSE:13.2:Update/.libssh2_org.5004.new/libssh2_org.changes 2016-04-29 10:35:26.000000000 +0200 @@ -0,0 +1,339 @@ +------------------------------------------------------------------- +Thu Apr 21 14:57:27 UTC 2016 - pjanouch@suse.de + +- add bsc974691.patch (bsc#974691) + +------------------------------------------------------------------- +Tue Feb 23 13:56:38 UTC 2016 - vcizek@suse.com + +- fix CVE-2016-0787 (boo#967026) + * Weakness in diffie-hellman secret key generation + * add CVE-2016-0787.patch + +------------------------------------------------------------------- +Wed Mar 11 14:00:34 UTC 2015 - vcizek@suse.com + +- update to 1.5.0 + * fixes CVE-2015-1782 (bnc#921070) +Changes in 1.5.0: + Added Windows Cryptography API: Next Generation based backend +Bug fixes: + Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782 + missing _libssh2_error in _libssh2_channel_write + knownhost: Fix DSS keys being detected as unknown. + knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer. + libssh2.h: on Windows, a socket is of type SOCKET, not int + libssh2_priv.h: a 1 bit bit-field should be unsigned + windows build: do not export externals from static library + Fixed two potential use-after-frees of the payload buffer + Fixed a few memory leaks in error paths + userauth: Fixed an attempt to free from stack on error + agent_list_identities: Fixed memory leak on OOM + knownhosts: Abort if the hosts buffer is too small + sftp_close_handle: ensure the handle is always closed + channel_close: Close the channel even in the case of errors + docs: added missing libssh2_session_handshake.3 file + docs: fixed a bunch of typos + userauth_password: pass on the underlying error code + _libssh2_channel_forward_cancel: accessed struct after free + _libssh2_packet_add: avoid using uninitialized memory + _libssh2_channel_forward_cancel: avoid memory leaks on error + _libssh2_channel_write: client spins on write when window full + windows build: fix build errors + publickey_packet_receive: avoid junk in returned pointers + channel_receive_window_adjust: store windows size always + userauth_hostbased_fromfile: zero assign to avoid uninitialized use + configure: change LIBS not LDFLAGS when checking for libs + agent_connect_unix: make sure there's a trailing zero + MinGW build: Fixed redefine warnings. + sftpdir.c: added authentication method detection. + Watcom build: added support for WinCNG build. + configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS + sftp_statvfs: fix for servers not supporting statfvs extension + knownhost.c: use LIBSSH2_FREE macro instead of free + Fixed compilation using mingw-w64 + knownhost.c: fixed that 'key_type_len' may be used uninitialized + configure: Display individual crypto backends on separate lines + examples on Windows: check for WSAStartup return code + examples on Windows: check for socket return code + agent.c: check return code of MapViewOfFile + kex.c: fix possible NULL pointer de-reference with session->kex + packet.c: fix possible NULL pointer de-reference within listen_state + tests on Windows: check for WSAStartup return code + userauth.c: improve readability and clarity of for-loops + examples on Windows: use native SOCKET-type instead of int + packet.c: i < 256 was always true and i would overflow to 0 + kex.c: make sure mlist is not set to NULL + session.c: check return value of session_nonblock in debug mode + session.c: check return value of session_nonblock during startup + userauth.c: make sure that sp_len is positive and avoid overflows + knownhost.c: fix use of uninitialized argument variable wrote + openssl: initialise the digest context before calling EVP_DigestInit() + libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET + configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib + configure.ac: Rework crypto library detection + configure.ac: Reorder --with-* options in --help output + configure.ac: Call zlib zlib and not libz in text but keep option names + Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro + sftp: seek: Don't flush buffers on same offset + sftp: statvfs: Along error path, reset the correct 'state' variable. + sftp: Add support for fsync (OpenSSH extension). + _libssh2_channel_read: fix data drop when out of window + comp_method_zlib_decomp: Improve buffer growing algorithm + _libssh2_channel_read: Honour window_size_initial + window_size: redid window handling for flow control reasons + knownhosts: handle unknown key types + +------------------------------------------------------------------- +Mon Jun 24 12:58:02 UTC 2013 - mvyskocil@suse.com + +- ignore groff-full to remove factory build cycle +- add groff to build requires to make tests passing + +------------------------------------------------------------------- +Wed Apr 24 07:54:17 UTC 2013 - boris@steki.net + +- fix building on older kernels and older OS / SLE + +------------------------------------------------------------------- +Thu Feb 28 21:13:29 UTC 2013 - crrodriguez@opensuse.org + +- Use AC_CONFIG_HEADERS instead of AM_CONFIG_HEADER, fixes + build with new automake + +------------------------------------------------------------------- +Tue Jan 8 15:24:25 UTC 2013 - vcizek@suse.com + +- update to 1.4.3 + compression: add support for zlib@openssh.com + Bug fixes: + sftp_read: return error if a too large package arrives + libssh2_hostkey_hash.3: update the description of return value + examples: use stderr for messages, stdout for data + openssl: do not leak memory when handling errors + improved handling of disabled MD5 algorithm in OpenSSL + known_hosts: Fail when parsing unknown keys in known_hosts file + configure: gcrypt doesn't come with pkg-config support + session_free: wrong variable used for keeping state + libssh2_userauth_publickey_fromfile_ex.3: mention publickey == NULL + comp_method_zlib_decomp: handle Z_BUF_ERROR when inflating + Return LIBSSH2_ERROR_SOCKET_DISCONNECT on EOF when reading banner + userauth.c: fread() from public key file to correctly detect any errors + configure.ac: Add option to disable build of the example applications + Added 'Requires.private:' line to libssh2.pc + SFTP: filter off incoming "zombie" responses + gettimeofday: no need for a replacement under cygwin + SSH_MSG_CHANNEL_REQUEST: default to want_reply + win32/libssh2_config.h: Remove hardcoded #define LIBSSH2_HAVE_ZLIB + build error with gcrypt backend + always do "forced" window updates to avoid corner case stalls + aes: the init function fails when OpenSSL has AES support + transport_send: Finish in-progress key exchange before sending data + channel_write: acknowledge transport errors + examples/x11.c: Make sure sizeof passed to read operation is correct + examples/x11.c:,Fix suspicious sizeof usage + sftp_packet_add: verify the packet before accepting it + SFTP: preserve the original error code more + sftp_packet_read: adjust window size as necessary + Use safer snprintf rather then sprintf in several places + Define and use LIBSSH2_INVALID_SOCKET instead of INVALID_SOCKET + sftp_write: cannot return acked data *and* EAGAIN + sftp_read: avoid data *and* EAGAIN + libssh2.h: Add missing prototype for libssh2_session_banner_set() +- dropped patches (already in the upstream) + 0004-libssh2.h-Add-missing-prototype-for-libssh2_session_.patch + 0005-Add-symbol-versioning.patch + 0006-missing-libssh2_session_banner_set.patch + +------------------------------------------------------------------- +Thu Feb 2 13:36:17 UTC 2012 - crrodriguez@opensuse.org + +- fix license + +------------------------------------------------------------------- +Thu Feb 2 04:27:50 UTC 2012 - crrodriguez@opensuse.org + +- Update to version 1.4.0 plus git bugfixes + +------------------------------------------------------------------- +Tue Dec 27 03:41:32 UTC 2011 - crrodriguez@opensuse.org + +- Refresh patches. + +------------------------------------------------------------------- +Thu Dec 1 03:41:02 UTC 2011 - jengelh@medozas.de + +- Remove redundant/unwanted tags/section (cf. specfile guidelines) + +------------------------------------------------------------------- +Thu Dec 1 02:43:46 UTC 2011 - crrodriguez@opensuse.org + +- open library file descriptors with O_CLOEXEC + +------------------------------------------------------------------- +Fri Oct 21 18:15:49 UTC 2011 - crrodriguez@opensuse.org + +- Update to version 1.3.0 +* sftp_read: advance offset correctly for buffered copies +* libssh2_sftp_seek64: flush packetlist and buffered data +* _libssh2_packet_add: adjust window size when truncating +* sftp_read: a short read is not end of file + + +------------------------------------------------------------------- +Sat Oct 1 14:19:34 CEST 2011 - dmueller@suse.de + +- document the reason for the testsuite failure + +------------------------------------------------------------------- +Fri Sep 30 17:36:36 UTC 2011 - crrodriguez@opensuse.org + +- Workaround qemu-arm problems. + +------------------------------------------------------------------- +Tue Sep 6 04:42:00 UTC 2011 - crrodriguez@opensuse.org + +- respect user's openssl.cnf engine configuration, might + want to do crypto with aes-ni, intel-accell or use rdrand ++++ 142 more lines (skipped) ++++ between /dev/null ++++ and /work/SRC/openSUSE:13.2:Update/.libssh2_org.5004.new/libssh2_org.changes New: ---- CVE-2016-0787.patch baselibs.conf bsc974691.patch libssh2-1.5.0.tar.gz libssh2-ocloexec.patch libssh2_org.changes libssh2_org.spec ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libssh2_org.spec ++++++ # # spec file for package libssh2_org # # Copyright (c) 2016 SUSE LINUX GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed # upon. The license for this file, and modifications and additions to the # file, is the same license as for the pristine package itself (unless the # license for the pristine package is not an Open Source License, in which # case the license is the MIT License). An "Open Source License" is a # license that conforms to the Open Source Definition (Version 1.9) # published by the Open Source Initiative. # Please submit bugfixes or comments via http://bugs.opensuse.org/ # Summary: A library implementing the SSH2 protocol License: BSD-3-Clause Group: Development/Libraries/C and C++ Name: libssh2_org Version: 1.5.0 Release: 0 Url: http://www.libssh2.org/ %define pkg_name libssh2 Source0: http://www.libssh2.org/download/%{pkg_name}-%{version}.tar.gz Source2: baselibs.conf BuildRequires: openssl-devel BuildRequires: pkgconfig BuildRequires: zlib-devel #for the test suite BuildRequires: groff BuildRequires: libtool BuildRequires: man BuildRequires: openssh # drops build cycle in Factory #!BuildIgnore: groff-full BuildRoot: %{_tmppath}/%{name}-%{version}-build Patch0: libssh2-ocloexec.patch Patch1: CVE-2016-0787.patch Patch2: bsc974691.patch %description libssh2 is a library implementing the SSH2 protocol as defined by Internet Drafts: SECSH-TRANS, SECSH-USERAUTH, SECSH-CONNECTION, SECSH-ARCH, SECSH-FILEXFER, SECSH-DHGEX, SECSH-NUMBERS, and SECSH-PUBLICKEY. %package -n libssh2-1 Summary: A library implementing the SSH2 protocol Group: Development/Libraries/C and C++ %description -n libssh2-1 libssh2 is a library implementing the SSH2 protocol as defined by Internet Drafts: SECSH-TRANS, SECSH-USERAUTH, SECSH-CONNECTION, SECSH-ARCH, SECSH-FILEXFER, SECSH-DHGEX, SECSH-NUMBERS, and SECSH-PUBLICKEY. %package -n libssh2-devel Summary: A library implementing the SSH2 protocol Group: Development/Libraries/C and C++ Requires: glibc-devel Requires: libssh2-1 = %{version} %description -n libssh2-devel libssh2 is a library implementing the SSH2 protocol as defined by Internet Drafts: SECSH-TRANS, SECSH-USERAUTH, SECSH-CONNECTION, SECSH-ARCH, SECSH-FILEXFER, SECSH-DHGEX, SECSH-NUMBERS, and SECSH-PUBLICKEY. %prep %setup -q -n %{pkg_name}-%{version} # problem with sle 11 sp1 target as it has older kernel and as such fail this %if 0%{?suse_version} > 1110 %patch0 -p1 %endif %patch1 -p1 %patch2 -p1 %build sed -i -e 's@AM_CONFIG_HEADER@AC_CONFIG_HEADERS@g' configure.ac cp src/libssh2_config.h.in example/libssh2_config.h # remove m4 macro files for libtool as they should be picked up by # autoreconf rm -v m4/libtool.m4 m4/lt* autoreconf -fiv export CFLAGS="%optflags -DOPENSSL_LOAD_CONF" %configure \ --disable-static --with-pic \ --disable-rpath --with-libz=%{_prefix} \ --with-openssl=%{_prefix} make %{?_smp_mflags} %if !0%{?sles_version} %if 0%{?suse_version} >= 1230 %check make check %endif %endif %install make install DESTDIR=%{buildroot} rm -f %{buildroot}%{_libdir}/*.la %{buildroot}%{_libdir}/*.a %post -n libssh2-1 -p /sbin/ldconfig %postun -n libssh2-1 -p /sbin/ldconfig %files -n libssh2-1 %defattr(-,root,root) %{_libdir}/libssh2.so.1* %files -n libssh2-devel %defattr(-,root,root) %doc NEWS %{_libdir}/libssh2.so %{_includedir}/*.h %{_mandir}/man3/* %{_libdir}/pkgconfig/libssh2.pc %changelog ++++++ CVE-2016-0787.patch ++++++

From 8a453a7b0f1e667b7369eb73b00843a8decdecc9 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Thu, 11 Feb 2016 13:52:20 +0100 Subject: [PATCH] diffie_hellman_sha256: convert bytes to bits

As otherwise we get far too small numbers. CVE-2016-0787 --- src/kex.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Index: libssh2-1.5.0/src/kex.c =================================================================== --- libssh2-1.5.0.orig/src/kex.c 2015-03-11 08:06:02.000000000 +0100 +++ libssh2-1.5.0/src/kex.c 2016-02-23 14:56:29.029375454 +0100 @@ -103,7 +103,7 @@ static int diffie_hellman_sha1(LIBSSH2_S memset(&exchange_state->req_state, 0, sizeof(packet_require_state_t)); /* Generate x and e */ - _libssh2_bn_rand(exchange_state->x, group_order, 0, -1); + _libssh2_bn_rand(exchange_state->x, group_order * 8 - 1, 0, -1); _libssh2_bn_mod_exp(exchange_state->e, g, exchange_state->x, p, exchange_state->ctx); ++++++ baselibs.conf ++++++ libssh2-1 obsoletes "libssh2-<targettype> <= <version>" provides "libssh2-<targettype> = <version>" ++++++ bsc974691.patch ++++++ commit 14d9ee01bc52ab55b44b1c402e810aa52e6a1364 Author: Will Cosgrove Date: Thu Mar 12 16:28:26 2015 +0000 Must init HMAC_CTX before using it. Must init ctx before using it or openssl will reuse the hmac which is not thread safe and causes a crash. Added libssh2_hmac_ctx_init macro. diff --git a/src/knownhost.c b/src/knownhost.c index d6ab821..102cdee 100644 --- a/src/knownhost.c +++ b/src/knownhost.c @@ -418,6 +418,7 @@ knownhost_check(LIBSSH2_KNOWNHOSTS *hosts, stored hash. */ libssh2_hmac_ctx ctx; + libssh2_hmac_ctx_init(ctx); unsigned char hash[SHA_DIGEST_LENGTH]; if(SHA_DIGEST_LENGTH != node->name_len) { diff --git a/src/libgcrypt.h b/src/libgcrypt.h index 813fd2a..2a50a20 100644 --- a/src/libgcrypt.h +++ b/src/libgcrypt.h @@ -82,6 +82,7 @@ gcry_md_hash_buffer (GCRY_MD_MD5, out, message, len) #define libssh2_hmac_ctx gcry_md_hd_t +#define libssh2_hmac_ctx_init(ctx) #define libssh2_hmac_sha1_init(ctx, key, keylen) \ gcry_md_open (ctx, GCRY_MD_SHA1, GCRY_MD_FLAG_HMAC), \ gcry_md_setkey (*ctx, key, keylen) diff --git a/src/mac.c b/src/mac.c index 76894fc..d95f740 100644 --- a/src/mac.c +++ b/src/mac.c @@ -113,6 +113,7 @@ mac_method_hmac_sha1_hash(LIBSSH2_SESSION * session, _libssh2_htonu32(seqno_buf, seqno); + libssh2_hmac_ctx_init(ctx); libssh2_hmac_sha1_init(&ctx, *abstract, 20); libssh2_hmac_update(ctx, seqno_buf, 4); libssh2_hmac_update(ctx, packet, packet_len); @@ -186,6 +186,7 @@ mac_method_hmac_md5_hash(LIBSSH2_SESSION * session, unsigned char *buf, _libssh2_htonu32(seqno_buf, seqno); + libssh2_hmac_ctx_init(ctx); libssh2_hmac_md5_init(&ctx, *abstract, 16); libssh2_hmac_update(ctx, seqno_buf, 4); libssh2_hmac_update(ctx, packet, packet_len); @@ -258,6 +259,7 @@ mac_method_hmac_ripemd160_hash(LIBSSH2_SESSION * session, _libssh2_htonu32(seqno_buf, seqno); + libssh2_hmac_ctx_init(ctx); libssh2_hmac_ripemd160_init(&ctx, *abstract, 20); libssh2_hmac_update(ctx, seqno_buf, 4); libssh2_hmac_update(ctx, packet, packet_len); diff --git a/src/openssl.h b/src/openssl.h index 5533014..46cf90c 100644 --- a/src/openssl.h +++ b/src/openssl.h @@ -121,6 +121,8 @@ int libssh2_md5_init(libssh2_md5_ctx *); void libssh2_md5(const unsigned char *message, unsigned long len, unsigned char *out); #define libssh2_hmac_ctx HMAC_CTX +#define libssh2_hmac_ctx_init(ctx) \ + HMAC_CTX_init(&ctx) #define libssh2_hmac_sha1_init(ctx, key, keylen) \ HMAC_Init(ctx, key, keylen, EVP_sha1()) #define libssh2_hmac_md5_init(ctx, key, keylen) \ ++++++ libssh2-ocloexec.patch ++++++

From 33a59a1905feb5d786e9d457f287dd9e81a9f747 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cristian=20Rodr=C3=ADguez?= Date: Tue, 27 Dec 2011 00:33:28 -0300 Subject: [PATCH] Use O_CLOEXEC where needed

--- src/agent.c | 2 +- src/knownhost.c | 4 ++-- src/userauth.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) Index: libssh2-1.4.3/src/agent.c =================================================================== --- libssh2-1.4.3.orig/src/agent.c 2012-03-05 20:04:56.000000000 +0100 +++ libssh2-1.4.3/src/agent.c 2013-01-08 16:24:07.572195659 +0100 @@ -152,7 +152,7 @@ agent_connect_unix(LIBSSH2_AGENT *agent) return _libssh2_error(agent->session, LIBSSH2_ERROR_BAD_USE, "no auth sock variable"); - agent->fd = socket(PF_UNIX, SOCK_STREAM, 0); + agent->fd = socket(PF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0); if (agent->fd < 0) return _libssh2_error(agent->session, LIBSSH2_ERROR_BAD_SOCKET, "failed creating socket"); Index: libssh2-1.4.3/src/knownhost.c =================================================================== --- libssh2-1.4.3.orig/src/knownhost.c 2012-08-21 20:27:22.000000000 +0200 +++ libssh2-1.4.3/src/knownhost.c 2013-01-08 16:24:07.573195691 +0100 @@ -907,7 +907,7 @@ libssh2_knownhost_readfile(LIBSSH2_KNOWN "Unsupported type of known-host information " "store"); - file = fopen(filename, "r"); + file = fopen(filename, "re"); if(file) { while(fgets(buf, sizeof(buf), file)) { if(libssh2_knownhost_readline(hosts, buf, strlen(buf), type)) { @@ -1082,7 +1082,7 @@ libssh2_knownhost_writefile(LIBSSH2_KNOW "Unsupported type of known-host information " "store"); - file = fopen(filename, "w"); + file = fopen(filename, "we"); if(!file) return _libssh2_error(hosts->session, LIBSSH2_ERROR_FILE, "Failed to open file"); Index: libssh2-1.4.3/src/userauth.c =================================================================== --- libssh2-1.4.3.orig/src/userauth.c 2012-04-18 22:24:04.000000000 +0200 +++ libssh2-1.4.3/src/userauth.c 2013-01-08 16:24:07.573195691 +0100 @@ -467,7 +467,7 @@ file_read_publickey(LIBSSH2_SESSION * se _libssh2_debug(session, LIBSSH2_TRACE_AUTH, "Loading public key file: %s", pubkeyfile); /* Read Public Key */ - fd = fopen(pubkeyfile, "r"); + fd = fopen(pubkeyfile, "re"); if (!fd) { return _libssh2_error(session, LIBSSH2_ERROR_FILE, "Unable to open public key file");