-
openssh (1:5.3p1-3ubuntu7.1) lucid-security; urgency=medium
* SECURITY UPDATE: AcceptEnv wildcard environment restrictions bypass
- debian/patches/CVE-2014-2532.patch: don't allow invalid chars in
session.c.
- CVE-2014-2532
-- Marc Deslauriers <email address hidden> Fri, 21 Mar 2014 11:07:31 -0400
-
openssh (1:5.3p1-3ubuntu7) lucid-proposed; urgency=low
[ Clint Byrum ]
* debian/openssh-server.ssh.init: Adding upstart awareness that will
call /lib/init/upstart-job when script is run outside of a chroot.
While this fixes LP: #531912, the change should be reverted when
upstart gains chroot session support.
[ Colin Watson ]
* Only do the above if /etc/init/ssh.conf still exists, since apparently
some people have been removing it.
-- Clint Byrum <email address hidden> Fri, 10 Jun 2011 22:46:07 -0700
-
openssh (1:5.3p1-3ubuntu6) lucid-proposed; urgency=low
* Stop Upstart job on runlevel [!2345] rather than just S, since
/etc/init.d/sendsigs no longer kills jobs under Upstart's control
(thanks, Rob Donovan; LP: #603363).
-- Clint Byrum <email address hidden> Sat, 12 Feb 2011 08:38:43 -0800
-
openssh (1:5.3p1-3ubuntu5) lucid-proposed; urgency=low
* debian/openssh-server.ssh.upstart: drop 'expect fork' and run sshd
with -D to avoid losing track on reload (LP: #687535)
-- Imre Gergely <email address hidden> Fri, 07 Jan 2011 10:19:13 +0000
-
openssh (1:5.3p1-3ubuntu4) lucid-proposed; urgency=low
* Backport from trunk:
- Hardcode the location of xauth to /usr/bin/xauth rather than
/usr/bin/X11/xauth (thanks, Aron Griffis; LP: #582251). xauth no
longer depends on x11-common, so we're no longer guaranteed to have
the /usr/bin/X11 symlink available.
-- Colin Watson <email address hidden> Tue, 18 May 2010 18:10:23 +0100
-
openssh (1:5.3p1-3ubuntu3) lucid; urgency=low
* Fix syntax error in openssh-server apport hook (LP: #534365).
-- Colin Watson <email address hidden> Mon, 08 Mar 2010 15:24:44 +0000
-
openssh (1:5.3p1-3ubuntu2) lucid; urgency=low
* Always set child processes' OOM adjustment to 0, since Upstart will have
set sshd's OOM adjustment on startup and so simply restoring the startup
value won't work (LP: #293000). Thanks to Karsten Suehring for
analysis.
* Limit automatic respawning to 10 times in 5 seconds (thanks to Fumihito
YOSHIDA for the suggestion; LP: #533352).
-- Colin Watson <email address hidden> Sat, 06 Mar 2010 22:00:19 +0000
-
openssh (1:5.3p1-3ubuntu1) lucid; urgency=low
* Resynchronise with Debian. Remaining changes:
- Add support for registering ConsoleKit sessions on login.
- Drop openssh-blacklist and openssh-blacklist-extra to Suggests; they
take up a lot of CD space, and I suspect that rolling them out in
security updates has covered most affected systems now.
- Convert to Upstart. The init script is still here for the benefit of
people running sshd in chroots.
- Install apport hook.
openssh (1:5.3p1-3) unstable; urgency=low
* Convert to source format 3.0 (quilt).
* Update README.source to match, and add a 'quilt-setup' target to
debian/rules for the benefit of those checking out the package from
revision control.
* All patches are now maintained separately and tagged according to DEP-3.
* Add GSSAPIStoreCredentialsOnRekey to 'sshd -T' configuration dump.
* Remove documentation of building for Debian 3.0 in README.Debian.
Support for this was removed in 1:4.7p1-2.
* Remove obsolete header from README.Debian dating from when people
expected non-free SSH.
* Update copyright years for GSSAPI patch.
openssh (1:5.3p1-2) unstable; urgency=low
* Link with -Wl,--as-needed (closes: #560155).
* Install upstream sshd_config as an example (closes: #415008).
* Use dh_lintian.
* Honour DEB_BUILD_OPTIONS=nocheck.
-- Colin Watson <email address hidden> Mon, 01 Mar 2010 22:01:14 +0000
-
openssh (1:5.3p1-1ubuntu2) lucid; urgency=low
[ Chuck Short ]
* Install apport hook; part of the server-lucid-apport-hooks
specification.
-- Colin Watson <email address hidden> Sun, 14 Feb 2010 02:21:13 +0000
-
openssh (1:5.3p1-1ubuntu1) lucid; urgency=low
* Resynchronise with Debian. Remaining changes:
- Add support for registering ConsoleKit sessions on login.
- Drop openssh-blacklist and openssh-blacklist-extra to Suggests; they
take up a lot of CD space, and I suspect that rolling them out in
security updates has covered most affected systems now.
- Convert to Upstart. The init script is still here for the benefit of
people running sshd in chroots.
openssh (1:5.3p1-1) unstable; urgency=low
* New upstream release.
* Update to GSSAPI patch from
http://www.sxw.org.uk/computing/patches/openssh-5.3p1-gsskex-all-20100124.patch.
* Backport from upstream:
- Do not fall back to adding keys without contraints (ssh-add -c / -t
...) when the agent refuses the constrained add request. This was a
useful migration measure back in 2002 when constraints were new, but
just adds risk now (LP: #209447).
* Drop change from 1:3.8p1-3 to avoid setresuid() and setresgid() system
calls. This only applied to Linux 2.2, which it's no longer feasible to
run anyway (see 1:5.2p1-2 changelog).
-- Colin Watson <email address hidden> Tue, 26 Jan 2010 13:07:40 +0000
-
openssh (1:5.2p1-2ubuntu1) lucid; urgency=low
* Resynchronise with Debian. Remaining changes:
- Add support for registering ConsoleKit sessions on login.
- Drop openssh-blacklist and openssh-blacklist-extra to Suggests; they
take up a lot of CD space, and I suspect that rolling them out in
security updates has covered most affected systems now.
- Convert to Upstart. The init script is still here for the benefit of
people running sshd in chroots.
openssh (1:5.2p1-2) unstable; urgency=low
[ Colin Watson ]
* Backport from upstream:
- After sshd receives a SIGHUP, ignore subsequent HUPs while sshd
re-execs itself. Prevents two HUPs in quick succession from resulting
in sshd dying (LP: #497781).
- Output a debug if we can't open an existing keyfile (LP: #505301).
* Use host compiler for ssh-askpass-gnome when cross-compiling.
* Don't run tests when cross-compiling.
* Drop change from 1:3.6.1p2-5 to disable cmsg_type check for file
descriptor passing when running on Linux 2.0. The previous stable
release of Debian dropped support for Linux 2.4, let alone 2.0, so this
very likely has no remaining users depending on it.
[ Kees Cook ]
* Implement DebianBanner server configuration flag that can be set to "no"
to allow sshd to run without the Debian-specific extra version in the
initial protocol handshake (closes: #562048).
-- Colin Watson <email address hidden> Sat, 16 Jan 2010 03:58:17 +0000
-
openssh (1:5.2p1-1ubuntu1) lucid; urgency=low
* Resynchronise with Debian. Remaining changes:
- Add support for registering ConsoleKit sessions on login.
- Drop openssh-blacklist and openssh-blacklist-extra to Suggests; they
take up a lot of CD space, and I suspect that rolling them out in
security updates has covered most affected systems now.
* Convert to Upstart. The init script is still here for the benefit of
people running sshd in chroots. Note that the Upstart job does not
support /etc/default/ssh, because it's much more straightforward to edit
the job (/etc/init/ssh.conf) than it was to edit the init script.
openssh (1:5.2p1-1) unstable; urgency=low
* New upstream release (closes: #536182). Yes, I know 5.3p1 has been out
for a while, but there's no GSSAPI patch available for it yet.
- Change the default cipher order to prefer the AES CTR modes and the
revised "arcfour256" mode to CBC mode ciphers that are susceptible to
CPNI-957037 "Plaintext Recovery Attack Against SSH".
- Add countermeasures to mitigate CPNI-957037-style attacks against the
SSH protocol's use of CBC-mode ciphers. Upon detection of an invalid
packet length or Message Authentication Code, ssh/sshd will continue
reading up to the maximum supported packet length rather than
immediately terminating the connection. This eliminates most of the
known differences in behaviour that leaked information about the
plaintext of injected data which formed the basis of this attack
(closes: #506115, LP: #379329).
- ForceCommand directive now accepts commandline arguments for the
internal-sftp server (closes: #524423, LP: #362511).
- Add AllowAgentForwarding to available Match keywords list (closes:
#540623).
- Make ssh(1) send the correct channel number for
SSH2_MSG_CHANNEL_SUCCESS and SSH2_MSG_CHANNEL_FAILURE messages to
avoid triggering 'Non-public channel' error messages on sshd(8) in
openssh-5.1.
- Avoid printing 'Non-public channel' warnings in sshd(8), since the
ssh(1) has sent incorrect channel numbers since ~2004 (this reverts a
behaviour introduced in openssh-5.1; closes: #496017).
- Disable nonfunctional ssh(1) ~C escape handler in multiplex slave
connections (closes: #507541).
- Fix "whitepsace" typo in ssh_config(5) (closes: #514313, LP: #303835).
* Update to GSSAPI patch from
http://www.sxw.org.uk/computing/patches/openssh-5.2p1-gsskex-all-20090726.patch,
including cascading credentials support (LP: #416958).
* Use x11.pc when compiling/linking gnome-ssh-askpass2 (closes: #555951).
* Moved to bzr.debian.org; add Vcs-Bzr and Vcs-Browser control fields.
* Add debian/README.source with instructions on bzr handling.
* Make ChrootDirectory work with SELinux (thanks, Russell Coker; closes:
#556644).
* Initialise sc to NULL in ssh_selinux_getctxbyname (thanks, Václav Ovsík;
closes: #498684).
* Don't duplicate backslashes when displaying server banner (thanks,
Michał Górny; closes: #505378, LP: #425346).
* Use hardening-includes for hardening logic (thanks, Kees Cook; closes:
#561887).
* Update OpenSSH FAQ to revision 1.110.
* Remove ssh/new_config, only needed for direct upgrades from potato which
are no longer particularly feasible anyway (closes: #420682).
* Cope with insserv reordering of init script links.
* Remove init script stop link in rc1, as killprocs handles it already.
* Adjust short descriptions to avoid relying on previous experience with
rsh, based on suggestions from Reuben Thomas (closes: #512198).
* Remove manual page references to login.conf, which aren't applicable on
non-BSD systems (closes: #154434).
* Remove/adjust manual page references to BSD-specific /etc/rc (closes:
#513417).
* Refer to sshd_config(5) rather than sshd(8) in postinst-written
/etc/ssh/sshd_config, and add UsePAM commentary from upstream-shipped
configuration file (closes: #415008, although unfortunately this will
only be conveniently visible on new installations).
* Include URL to OpenBSD's ssl(8) in ssh(1), since I don't see a better
source for the same information among Debian's manual pages (closes:
#530692, LP: #456660).
-- Colin Watson <email address hidden> Mon, 04 Jan 2010 13:45:21 +0000
-
openssh (1:5.1p1-8ubuntu2) lucid; urgency=low
* Add -Wl,-z,now to LDFLAGS to enhance the existing RELRO hardening
done by the Ubuntu compiler (Debian bug 561887).
-- Kees Cook <email address hidden> Wed, 23 Dec 2009 21:59:05 -0800
-
openssh (1:5.1p1-8ubuntu1) lucid; urgency=low
* Resynchronise with Debian. Remaining changes:
- Add support for registering ConsoleKit sessions on login.
- Drop openssh-blacklist and openssh-blacklist-extra to Suggests; they
take up a lot of CD space, and I suspect that rolling them out in
security updates has covered most affected systems now.
openssh (1:5.1p1-8) unstable; urgency=low
* Build with just -fPIC on mips/mipsel, not -fPIE as well (thanks, LIU Qi;
closes: #538313).
* Build-depend on libselinux1-dev on sh4 too (thanks, Nobuhiro Iwamatsu;
closes: #547103).
* Fix grammar in if-up script (closes: #549128).
* Pass $SSHD_OPTS when checking configuration too (thanks, "sobtwmxt";
closes: #548662).
openssh (1:5.1p1-7) unstable; urgency=low
* Update config.guess and config.sub from autotools-dev 20090611.1
(closes: #538301).
* Set umask to 022 in the init script as well as postinsts (closes:
#539030).
* Add ${misc:Depends} to keep Lintian happy.
* Use 'which' rather than 'type' in maintainer scripts.
* Upgrade to debhelper v7.
-- Colin Watson <email address hidden> Wed, 02 Dec 2009 20:21:06 +0000
-
openssh (1:5.1p1-6ubuntu2) karmic; urgency=low
* No change rebuild to fix misbuilt binaries on armel.
-- Loic Minier <email address hidden> Wed, 21 Oct 2009 14:48:08 +0200
