Bug#865986: stretch-pu: package openssh/1:7.4p1-10+deb9u2
Control: tag -1 confirmed
On Fri, Oct 6, 2017 at 21:34:59 +0100, Colin Watson wrote:
> I got kind of distracted and forgot about this, and in the meantime a
> few more bugs have become evident that ought to be fixed in stable, so
> here's an extended debdiff for approval.
>
> * #877800 causes current versions of WinSCP to be unable to connect due
> to overly-general version patterns in sshd's bug-compatibility code.
>
> * #873201 was implicated in a few CVEs a while back in packages using
> ssh; I'm not sure whether it *quite* counts as a security
> vulnerability in and of itself, but we should fix it anyway.
>
> (And yes, I'll deal with these in jessie too as necessary as soon as I
> summon the energy for oldstable updates.)
>
> A current version of git introduced a small amount of noise into the
> diff, but it's small enough that I don't think it's worth brutalising
> the tools to avoid it.
>
Looks fine to me, go ahead.
Cheers,
Julien
Reply to: