Bug#906236: openssh: CVE-2018-15473: delay bailout for invalid authenticating user until after the packet

To: Colin Watson <cjwatson@debian.org>, 906236@bugs.debian.org
Cc: Salvatore Bonaccorso <carnil@debian.org>, team@security.debian.org
Subject: Bug#906236: openssh: CVE-2018-15473: delay bailout for invalid authenticating user until after the packet
From: Chris Lamb <lamby@debian.org>
Date: Tue, 21 Aug 2018 18:19:09 +0100
Message-id: <[🔎] 1534871949.2919005.1481536216.04D728C7@webmail.messagingengine.com>
Reply-to: Chris Lamb <lamby@debian.org>, 906236@bugs.debian.org
In-reply-to: <[🔎] 20180821103946.aj32warldwpevyet@riva.ucam.org>
References: <[🔎] 153436226668.6714.11130467831594285376.reportbug@eldamar.local> <[🔎] 1534667577.892318.1478864568.4ECB7599@webmail.messagingengine.com> <[🔎] 20180821103946.aj32warldwpevyet@riva.ucam.org> <[🔎] 153436226668.6714.11130467831594285376.reportbug@eldamar.local>

Dear Colin et al.,

> This bit has the same memory leak problem that I noticed in Sébastien's
> backport for stretch

Great spot; thanks.


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Reply to:

References:
- Bug#906236: openssh: delay bailout for invalid authenticating user until after the packet
  - From: Salvatore Bonaccorso <carnil@debian.org>
- Bug#906236: openssh: CVE-2018-15473: delay bailout for invalid authenticating user until after the packet
  - From: Chris Lamb <lamby@debian.org>
- Bug#906236: openssh: CVE-2018-15473: delay bailout for invalid authenticating user until after the packet
  - From: Colin Watson <cjwatson@debian.org>

Prev by Date: Bug#906236: openssh: CVE-2018-15473: delay bailout for invalid authenticating user until after the packet
Next by Date: openssh_7.4p1-10+deb9u4_amd64.changes ACCEPTED into proposed-updates->stable-new
Previous by thread: Bug#906236: openssh: CVE-2018-15473: delay bailout for invalid authenticating user until after the packet
Next by thread: Bug#906236: openssh: CVE-2018-15473: delay bailout for invalid authenticating user until after the packet
Index(es):
- Date
- Thread