Bug#841884: marked as done (openssh: CVE-2016-8858: Memory exhaustion due to unregistered KEXINIT handler after receiving message)
Your message dated Mon, 24 Oct 2016 11:42:28 +0000
with message-id <E1byde8-0002f5-4g@franck.debian.org>
and subject line Bug#841884: fixed in openssh 1:7.3p1-2
has caused the Debian Bug report #841884,
regarding openssh: CVE-2016-8858: Memory exhaustion due to unregistered KEXINIT handler after receiving message
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)
--
841884: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=841884
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message ---
Source: openssh
Version: 1:6.7p1-5
Severity: normal
Tags: security upstream
Hi,
the following vulnerability was published for openssh.
CVE-2016-8858[0]:
|Memory exhaustion due to unregistered KEXINIT handler after receiving
|message
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2016-8858
[1] http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/kex.c?rev=1.127&content-type=text/x-cvsweb-markup
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1384860
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: openssh
Source-Version: 1:7.3p1-2
We believe that the bug you reported is fixed in the latest version of
openssh, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 841884@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Colin Watson <cjwatson@debian.org> (supplier of updated openssh package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Mon, 24 Oct 2016 11:18:00 +0100
Source: openssh
Binary: openssh-client openssh-client-ssh1 openssh-server openssh-sftp-server ssh ssh-krb5 ssh-askpass-gnome openssh-client-udeb openssh-server-udeb
Architecture: source
Version: 1:7.3p1-2
Distribution: unstable
Urgency: high
Maintainer: Debian OpenSSH Maintainers <debian-ssh@lists.debian.org>
Changed-By: Colin Watson <cjwatson@debian.org>
Description:
openssh-client - secure shell (SSH) client, for secure access to remote machines
openssh-client-ssh1 - secure shell (SSH) client for legacy SSH1 protocol
openssh-client-udeb - secure shell client for the Debian installer (udeb)
openssh-server - secure shell (SSH) server, for secure access from remote machines
openssh-server-udeb - secure shell server for the Debian installer (udeb)
openssh-sftp-server - secure shell (SSH) sftp server module, for SFTP access from remot
ssh - secure shell client and server (metapackage)
ssh-askpass-gnome - interactive X program to prompt users for a passphrase for ssh-ad
ssh-krb5 - secure shell client and server (transitional package)
Closes: 841884
Changes:
openssh (1:7.3p1-2) unstable; urgency=high
.
* Rewrite debian/copyright using copyright-format 1.0.
* CVE-2016-8858: Unregister the KEXINIT handler after message has been
received (closes: #841884).
Checksums-Sha1:
f55dc8702b29729b38531d4ceb060907b78d72f2 2884 openssh_7.3p1-2.dsc
fce0bbab019bfd3a57e8b629cbf35297971d79c2 152132 openssh_7.3p1-2.debian.tar.xz
Checksums-Sha256:
bae2b4b8eece5f0b7655512f4153ef0dbc60bcde47e88541a3a752b484436271 2884 openssh_7.3p1-2.dsc
7adcc6249b689c3cc57144cfbf521a89e2ea91e34995a41e9698bcd2715cffda 152132 openssh_7.3p1-2.debian.tar.xz
Files:
381129506ed873aa85034e881020b0b2 2884 net standard openssh_7.3p1-2.dsc
f08cf4f79d939cc1e0ef6c5ab649acd8 152132 net standard openssh_7.3p1-2.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Colin Watson <cjwatson@debian.org> -- Debian developer
iQIVAwUBWA3nuDk1h9l9hlALAQiWDA/9GSN/me94XbMiqX7LO64L5xmncyaxKPWr
LaaFtkxChCDL+njkwHGoEUMqIUYTq0FSHR8pQyT6gxlaEEFwCNxH31IdUIcgYVFp
e3weYTWMPlvE3zbPdRAVzO3rUXW0lnqjQZb27uciixUahSpzPUyGbue/ESjB6C1x
9NMwKQjeaiXvl2C2ZZWoMCE+p0litNWAGkIcaEwpOvzKRNdmgHgI7mrDEcFGD/nO
pvht6AReaG+HF3QH8TiZ6tr/SU/b5ueglURYLkHuC9Pa/Twjm40KFTNuedynSzqg
5eO7tWg0GMedMPBn8kYpQhzsu5jMI5IXbn5V7mNjZpfjJilUjMCYiqRv+TSOoD2t
j6Mbdfsni47yF95rVOihbTyhoFwl6T3MBNMKBL3IOVBa8U54gRvATddXw7Ep0aan
XdRMQj4LINM+OypQzEtduxgiwB+fUqfTRBAaWVL7G0DdIwxdgWtXARlj4bJt0GPe
pexdOm2pTrd9Qcc0HQVKixsuM4/CxJDztF0LrH7TlilOhispnGZZBe15bsSPFUvs
TU1D2wqMygtcJqrouZ+TpzYI6gG4YVmwN5/Waa5ua5wR99PJjUcqPqAredv96O1z
WRu5SQPJRjON5lDzV+OJnp92huvHPi7p7TU4slZRDDgz4mh9iRTAO/tQ+/Tx7nA5
ToBwJqHdH5U=
=50l1
-----END PGP SIGNATURE-----
--- End Message ---
Reply to: