Skip to content
Snippets Groups Projects
Commit 69529391 authored by Solar Designer's avatar Solar Designer
Browse files

8.7p1-43.el9_5.security.0.10 

- Rebase on 8.7p1-43
parent 1d0ba349
Branches r10s
No related merge requests found
Hide whitespace changes
Inline Side-by-side
SOURCES/openssh-7.7p1-fips.patch
+ 1
− 1
View file @ 69529391
...@@ -81,7 +81,7 @@ diff -up openssh-8.6p1/kex.c.fips openssh-8.6p1/kex.c ...@@ -81,7 +81,7 @@ diff -up openssh-8.6p1/kex.c.fips openssh-8.6p1/kex.c
#include <openssl/crypto.h> #include <openssl/crypto.h>
+#include <openssl/fips.h> +#include <openssl/fips.h>
#include <openssl/dh.h> #include <openssl/dh.h>
# ifdef HAVE_EVP_KDF_CTX_NEW_ID # ifdef HAVE_EVP_KDF_CTX_NEW
# include <openssl/kdf.h> # include <openssl/kdf.h>
@@ -203,7 +203,10 @@ kex_names_valid(const char *names) @@ -203,7 +203,10 @@ kex_names_valid(const char *names)
for ((p = strsep(&cp, ",")); p && *p != '\0'; for ((p = strsep(&cp, ",")); p && *p != '\0';
......
SOURCES/openssh-8.0p1-openssl-kdf.patch
+ 54
− 35
View file @ 69529391
...@@ -12,7 +12,7 @@ index 2a455e4e..e01c3d43 100644 ...@@ -12,7 +12,7 @@ index 2a455e4e..e01c3d43 100644
HMAC_CTX_init \ HMAC_CTX_init \
RSA_generate_key_ex \ RSA_generate_key_ex \
RSA_get_default_method \ RSA_get_default_method \
+ EVP_KDF_CTX_new_id \ + EVP_KDF_CTX_new \
]) ])
# OpenSSL_add_all_algorithms may be a macro. # OpenSSL_add_all_algorithms may be a macro.
...@@ -20,33 +20,35 @@ diff --git a/kex.c b/kex.c ...@@ -20,33 +20,35 @@ diff --git a/kex.c b/kex.c
index b6f041f4..1fbce2bb 100644 index b6f041f4..1fbce2bb 100644
--- a/kex.c --- a/kex.c
+++ b/kex.c +++ b/kex.c
@@ -38,6 +38,9 @@ @@ -38,6 +38,11 @@
#ifdef WITH_OPENSSL #ifdef WITH_OPENSSL
#include <openssl/crypto.h> #include <openssl/crypto.h>
#include <openssl/dh.h> #include <openssl/dh.h>
+# ifdef HAVE_EVP_KDF_CTX_NEW_ID +# ifdef HAVE_EVP_KDF_CTX_NEW
+# include <openssl/kdf.h> +# include <openssl/kdf.h>
+# include <openssl/param_build.h>
+# include <openssl/core_names.h>
+# endif +# endif
#endif #endif
#include "ssh.h" #include "ssh.h"
@@ -942,6 +945,95 @@ kex_choose_conf(struct ssh *ssh) @@ -942,6 +945,112 @@ kex_choose_conf(struct ssh *ssh)
return r; return r;
} }
+#ifdef HAVE_EVP_KDF_CTX_NEW_ID +#ifdef HAVE_EVP_KDF_CTX_NEW
+static const EVP_MD * +static const char *
+digest_to_md(int digest_type) +digest_to_md(int digest_type)
+{ +{
+ switch (digest_type) { + switch (digest_type) {
+ case SSH_DIGEST_SHA1: + case SSH_DIGEST_SHA1:
+ return EVP_sha1(); + return SN_sha1;
+ case SSH_DIGEST_SHA256: + case SSH_DIGEST_SHA256:
+ return EVP_sha256(); + return SN_sha256;
+ case SSH_DIGEST_SHA384: + case SSH_DIGEST_SHA384:
+ return EVP_sha384(); + return SN_sha384;
+ case SSH_DIGEST_SHA512: + case SSH_DIGEST_SHA512:
+ return EVP_sha512(); + return SN_sha512;
+ } + }
+ return NULL; + return NULL;
+} +}
...@@ -56,52 +58,67 @@ index b6f041f4..1fbce2bb 100644 ...@@ -56,52 +58,67 @@ index b6f041f4..1fbce2bb 100644
+ const struct sshbuf *shared_secret, u_char **keyp) + const struct sshbuf *shared_secret, u_char **keyp)
+{ +{
+ struct kex *kex = ssh->kex; + struct kex *kex = ssh->kex;
+ EVP_KDF_CTX *ctx = NULL;
+ u_char *key = NULL; + u_char *key = NULL;
+ int r, key_len; + int r, key_len;
+ +
+ if ((key_len = ssh_digest_bytes(kex->hash_alg)) == 0) + EVP_KDF *kdf = EVP_KDF_fetch(NULL, "SSHKDF", NULL);
+ return SSH_ERR_INVALID_ARGUMENT; + EVP_KDF_CTX *ctx = NULL;
+ key_len = ROUNDUP(need, key_len); + OSSL_PARAM_BLD *param_bld = OSSL_PARAM_BLD_new();
+ if ((key = calloc(1, key_len)) == NULL) { + OSSL_PARAM *params = NULL;
+ r = SSH_ERR_ALLOC_FAIL; + const char *md = digest_to_md(kex->hash_alg);
+ char keytype = (char)id;
+
+ if (!kdf) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out; + goto out;
+ } + }
+ + ctx = EVP_KDF_CTX_new(kdf);
+ ctx = EVP_KDF_CTX_new_id(EVP_KDF_SSHKDF); + EVP_KDF_free(kdf);
+ if (!ctx) { + if (!ctx) {
+ r = SSH_ERR_LIBCRYPTO_ERROR; + r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out; + goto out;
+ } + }
+ + if (md == NULL) {
+ r = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_MD, digest_to_md(kex->hash_alg)); + r = SSH_ERR_INVALID_ARGUMENT;
+ if (r != 1) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out; + goto out;
+ } + }
+ r = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KEY, +
+ sshbuf_ptr(shared_secret), sshbuf_len(shared_secret)); + if (param_bld == NULL) {
+ if (r != 1) { + EVP_KDF_CTX_free(ctx);
+ r = SSH_ERR_LIBCRYPTO_ERROR; + return -1;
+ }
+ if ((key_len = ssh_digest_bytes(kex->hash_alg)) == 0) {
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out; + goto out;
+ } + }
+ r = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_XCGHASH, hash, hashlen); +
+ if (r != 1) { + key_len = ROUNDUP(need, key_len);
+ r = SSH_ERR_LIBCRYPTO_ERROR; + if ((key = calloc(1, key_len)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out; + goto out;
+ } + }
+ r = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_TYPE, id); +
+ r = OSSL_PARAM_BLD_push_utf8_string(param_bld, OSSL_KDF_PARAM_DIGEST,
+ md, strlen(md)) && /* SN */
+ OSSL_PARAM_BLD_push_octet_string(param_bld, OSSL_KDF_PARAM_KEY,
+ sshbuf_ptr(shared_secret), sshbuf_len(shared_secret)) &&
+ OSSL_PARAM_BLD_push_octet_string(param_bld, OSSL_KDF_PARAM_SSHKDF_XCGHASH,
+ hash, hashlen) &&
+ OSSL_PARAM_BLD_push_octet_string(param_bld, OSSL_KDF_PARAM_SSHKDF_SESSION_ID,
+ sshbuf_ptr(kex->session_id), sshbuf_len(kex->session_id)) &&
+ OSSL_PARAM_BLD_push_utf8_string(param_bld, OSSL_KDF_PARAM_SSHKDF_TYPE,
+ &keytype, 1);
+ if (r != 1) { + if (r != 1) {
+ r = SSH_ERR_LIBCRYPTO_ERROR; + r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out; + goto out;
+ } + }
+ r = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_SESSION_ID, +
+ sshbuf_ptr(kex->session_id), sshbuf_len(kex->session_id)); + params = OSSL_PARAM_BLD_to_param(param_bld);
+ if (r != 1) { + if (params == NULL) {
+ r = SSH_ERR_LIBCRYPTO_ERROR; + r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out; + goto out;
+ } + }
+ r = EVP_KDF_derive(ctx, key, key_len); + r = EVP_KDF_derive(ctx, key, key_len, params);
+ if (r != 1) { + if (r != 1) {
+ r = SSH_ERR_LIBCRYPTO_ERROR; + r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out; + goto out;
...@@ -115,6 +132,8 @@ index b6f041f4..1fbce2bb 100644 ...@@ -115,6 +132,8 @@ index b6f041f4..1fbce2bb 100644
+ r = 0; + r = 0;
+ +
+out: +out:
+ OSSL_PARAM_BLD_free(param_bld);
+ OSSL_PARAM_free(params);
+ free (key); + free (key);
+ EVP_KDF_CTX_free(ctx); + EVP_KDF_CTX_free(ctx);
+ if (r < 0) { + if (r < 0) {
...@@ -130,7 +149,7 @@ index b6f041f4..1fbce2bb 100644 ...@@ -130,7 +149,7 @@ index b6f041f4..1fbce2bb 100644
ssh_digest_free(hashctx); ssh_digest_free(hashctx);
return r; return r;
} }
+#endif /* HAVE_OPENSSL_EVP_KDF_CTX_NEW_ID */ +#endif /* HAVE_OPENSSL_EVP_KDF_CTX_NEW */
#define NKEYS 6 #define NKEYS 6
int int
......
SOURCES/openssh-8.7p1-audit-hostname.patch 0 → 100644
+ 106
− 0
View file @ 69529391
diff --color -ruNp a/audit-linux.c b/audit-linux.c
--- a/audit-linux.c 2024-05-09 12:38:08.843017319 +0200
+++ b/audit-linux.c 2024-05-09 12:47:05.162267634 +0200
@@ -52,7 +52,7 @@ extern u_int utmp_len;
const char *audit_username(void);
static void
-linux_audit_user_logxxx(int uid, const char *username,
+linux_audit_user_logxxx(int uid, const char *username, const char *hostname,
const char *ip, const char *ttyn, int success, int event)
{
int audit_fd, rc, saved_errno;
@@ -66,7 +66,7 @@ linux_audit_user_logxxx(int uid, const c
}
rc = audit_log_acct_message(audit_fd, event,
NULL, "login", username ? username : "(unknown)",
- username == NULL ? uid : -1, NULL, ip, ttyn, success);
+ username == NULL ? uid : -1, hostname, ip, ttyn, success);
saved_errno = errno;
close(audit_fd);
@@ -181,9 +181,11 @@ audit_run_command(struct ssh *ssh, const
{
if (!user_login_count++)
linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL,
+ options.use_dns ? remote_hostname(ssh) : NULL,
ssh_remote_ipaddr(ssh),
"ssh", 1, AUDIT_USER_LOGIN);
linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL,
+ options.use_dns ? remote_hostname(ssh) : NULL,
ssh_remote_ipaddr(ssh),
"ssh", 1, AUDIT_USER_START);
return 0;
@@ -193,10 +195,12 @@ void
audit_end_command(struct ssh *ssh, int handle, const char *command)
{
linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL,
+ options.use_dns ? remote_hostname(ssh) : NULL,
ssh_remote_ipaddr(ssh),
"ssh", 1, AUDIT_USER_END);
if (user_login_count && !--user_login_count)
linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL,
+ options.use_dns ? remote_hostname(ssh) : NULL,
ssh_remote_ipaddr(ssh),
"ssh", 1, AUDIT_USER_LOGOUT);
}
@@ -211,19 +215,27 @@ void
audit_session_open(struct logininfo *li)
{
if (!user_login_count++)
- linux_audit_user_logxxx(li->uid, NULL, li->hostname,
+ linux_audit_user_logxxx(li->uid, NULL,
+ options.use_dns ? li->hostname : NULL,
+ options.use_dns ? NULL : li->hostname,
li->line, 1, AUDIT_USER_LOGIN);
- linux_audit_user_logxxx(li->uid, NULL, li->hostname,
+ linux_audit_user_logxxx(li->uid, NULL,
+ options.use_dns ? li->hostname : NULL,
+ options.use_dns ? NULL : li->hostname,
li->line, 1, AUDIT_USER_START);
}
void
audit_session_close(struct logininfo *li)
{
- linux_audit_user_logxxx(li->uid, NULL, li->hostname,
+ linux_audit_user_logxxx(li->uid, NULL,
+ options.use_dns ? li->hostname : NULL,
+ options.use_dns ? NULL : li->hostname,
li->line, 1, AUDIT_USER_END);
if (user_login_count && !--user_login_count)
- linux_audit_user_logxxx(li->uid, NULL, li->hostname,
+ linux_audit_user_logxxx(li->uid, NULL,
+ options.use_dns ? li->hostname : NULL,
+ options.use_dns ? NULL : li->hostname,
li->line, 1, AUDIT_USER_LOGOUT);
}
@@ -236,6 +248,7 @@ audit_event(struct ssh *ssh, ssh_audit_e
linux_audit_user_auth(-1, audit_username(),
ssh_remote_ipaddr(ssh), "ssh", 0, event);
linux_audit_user_logxxx(-1, audit_username(),
+ options.use_dns ? remote_hostname(ssh) : NULL,
ssh_remote_ipaddr(ssh), "ssh", 0, AUDIT_USER_LOGIN);
break;
case SSH_AUTH_FAIL_PASSWD:
@@ -254,9 +267,11 @@ audit_event(struct ssh *ssh, ssh_audit_e
if (user_login_count) {
while (user_login_count--)
linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL,
+ options.use_dns ? remote_hostname(ssh) : NULL,
ssh_remote_ipaddr(ssh),
"ssh", 1, AUDIT_USER_END);
linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL,
+ options.use_dns ? remote_hostname(ssh) : NULL,
ssh_remote_ipaddr(ssh),
"ssh", 1, AUDIT_USER_LOGOUT);
}
@@ -265,6 +280,7 @@ audit_event(struct ssh *ssh, ssh_audit_e
case SSH_CONNECTION_ABANDON:
case SSH_INVALID_USER:
linux_audit_user_logxxx(-1, audit_username(),
+ options.use_dns ? remote_hostname(ssh) : NULL,
ssh_remote_ipaddr(ssh), "ssh", 0, AUDIT_USER_LOGIN);
break;
default:
SOURCES/openssh-8.7p1-sigpipe.patch 0 → 100644
+ 21
− 0
View file @ 69529391
diff --git a/ssh.c b/ssh.c
index 89ca1940..559bf2af 100644
--- a/ssh.c
+++ b/ssh.c
@@ -1124,6 +1124,8 @@ main(int ac, char **av)
}
}
+ ssh_signal(SIGPIPE, SIG_IGN); /* ignore SIGPIPE early */
+
/*
* Initialize "log" output. Since we are the client all output
* goes to stderr unless otherwise specified by -y or -E.
@@ -1652,7 +1654,6 @@ main(int ac, char **av)
options.num_system_hostfiles);
tilde_expand_paths(options.user_hostfiles, options.num_user_hostfiles);
- ssh_signal(SIGPIPE, SIG_IGN); /* ignore SIGPIPE early */
ssh_signal(SIGCHLD, main_sigchld_handler);
/* Log into the remote system. Never returns if the login fails. */
SOURCES/sshd-keygen
+ 9
− 3
View file @ 69529391
...@@ -9,8 +9,14 @@ case $KEYTYPE in ...@@ -9,8 +9,14 @@ case $KEYTYPE in
if [[ -r "$FIPS" && $(cat $FIPS) == "1" ]]; then if [[ -r "$FIPS" && $(cat $FIPS) == "1" ]]; then
exit 0 exit 0
fi ;; fi ;;
"rsa") ;; # always ok "rsa")
"ecdsa") ;; if [[ ! -z $SSH_RSA_BITS ]]; then
SSH_KEYGEN_OPTIONS="-b $SSH_RSA_BITS"
fi ;; # always ok
"ecdsa")
if [[ ! -z $SSH_ECDSA_BITS ]]; then
SSH_KEYGEN_OPTIONS="-b $SSH_ECDSA_BITS"
fi ;;
*) # wrong argument *) # wrong argument
exit 12 ;; exit 12 ;;
esac esac
...@@ -25,7 +31,7 @@ fi ...@@ -25,7 +31,7 @@ fi
rm -f $KEY{,.pub} rm -f $KEY{,.pub}
# create new keys # create new keys
if ! $KEYGEN -q -t $KEYTYPE -f $KEY -C '' -N '' >&/dev/null; then if ! $KEYGEN -q -t $KEYTYPE $SSH_KEYGEN_OPTIONS -f $KEY -C '' -N '' >&/dev/null; then
exit 1 exit 1
fi fi
......
SOURCES/sshd.sysconfig
+ 3
− 0
View file @ 69529391
...@@ -5,3 +5,6 @@ ...@@ -5,3 +5,6 @@
# example using systemctl enable sshd-keygen@dsa.service to allow creation # example using systemctl enable sshd-keygen@dsa.service to allow creation
# of DSA key or systemctl mask sshd-keygen@rsa.service to disable RSA key # of DSA key or systemctl mask sshd-keygen@rsa.service to disable RSA key
# creation. # creation.
#SSH_RSA_BITS=3072
#SSH_ECDSA_BITS=256
SPECS/openssh.spec
+ 33
− 14
View file @ 69529391
...@@ -47,10 +47,10 @@ ...@@ -47,10 +47,10 @@
# Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
%global openssh_ver 8.7p1 %global openssh_ver 8.7p1
%global openssh_rel 38.4 %global openssh_rel 43
%global pam_ssh_agent_ver 0.10.4 %global pam_ssh_agent_ver 0.10.4
%global pam_ssh_agent_rel 5 %global pam_ssh_agent_rel 5
%global security_rel 0.9 %global security_rel 0.10
Summary: An open source implementation of SSH protocol version 2 Summary: An open source implementation of SSH protocol version 2
Name: openssh Name: openssh
...@@ -85,6 +85,8 @@ Patch100: openssh-6.7p1-coverity.patch ...@@ -85,6 +85,8 @@ Patch100: openssh-6.7p1-coverity.patch
Patch200: openssh-7.6p1-audit.patch Patch200: openssh-7.6p1-audit.patch
# Audit race condition in forked child (#1310684) # Audit race condition in forked child (#1310684)
Patch201: openssh-7.1p2-audit-race-condition.patch Patch201: openssh-7.1p2-audit-race-condition.patch
# Correctly audit hostname and IP address
Patch202: openssh-8.7p1-audit-hostname.patch
# --- pam_ssh-agent --- # --- pam_ssh-agent ---
# make it build reusing the openssh sources # make it build reusing the openssh sources
...@@ -289,7 +291,9 @@ Patch1017: openssh-9.4p2-limit-delay.patch ...@@ -289,7 +291,9 @@ Patch1017: openssh-9.4p2-limit-delay.patch
Patch1018: openssh-9.6p1-CVE-2023-48795.patch Patch1018: openssh-9.6p1-CVE-2023-48795.patch
#upstream commit 7ef3787c84b6b524501211b11a26c742f829af1a #upstream commit 7ef3787c84b6b524501211b11a26c742f829af1a
Patch1019: openssh-9.6p1-CVE-2023-51385.patch Patch1019: openssh-9.6p1-CVE-2023-51385.patch
Patch1020: openssh-9.8p1-upstream-cve-2024-6387.patch #upstream commit 96faa0de6c673a2ce84736eba37fc9fb723d9e5c
Patch1020: openssh-8.7p1-sigpipe.patch
Patch1021: openssh-9.8p1-upstream-cve-2024-6387.patch
Patch9000: openssh-8.7p1-rocky-systemd.patch Patch9000: openssh-8.7p1-rocky-systemd.patch
Patch9001: openssh-8.7p1-rocky-no-gssapi.patch Patch9001: openssh-8.7p1-rocky-no-gssapi.patch
...@@ -490,6 +494,7 @@ popd ...@@ -490,6 +494,7 @@ popd
%patch200 -p1 -b .audit %patch200 -p1 -b .audit
%patch201 -p1 -b .audit-race %patch201 -p1 -b .audit-race
%patch202 -p1 -b .audit-hostname
%patch700 -p1 -b .fips %patch700 -p1 -b .fips
%patch1000 -p1 -b .minimize-sha1-use %patch1000 -p1 -b .minimize-sha1-use
...@@ -517,10 +522,13 @@ popd ...@@ -517,10 +522,13 @@ popd
%patch1017 -p1 -b .limitdelay %patch1017 -p1 -b .limitdelay
%patch1018 -p1 -b .cve-2023-48795 %patch1018 -p1 -b .cve-2023-48795
%patch1019 -p1 -b .cve-2023-51385 %patch1019 -p1 -b .cve-2023-51385
%patch1020 -p1 -b .cve-2024-6387 %patch1020 -p1 -b .earlypipe
%patch1021 -p1 -b .cve-2024-6387
%patch9000 -p1 -b .rocky-systemd %patch9000 -p1 -b .rocky-systemd
%if ! %{kerberos5}
%patch9001 -p1 -b .rocky-no-gssapi %patch9001 -p1 -b .rocky-no-gssapi
%endif
autoreconf autoreconf
pushd pam_ssh_agent_auth-pam_ssh_agent_auth-%{pam_ssh_agent_ver} pushd pam_ssh_agent_auth-pam_ssh_agent_auth-%{pam_ssh_agent_ver}
...@@ -808,6 +816,9 @@ test -f %{sysconfig_anaconda} && \ ...@@ -808,6 +816,9 @@ test -f %{sysconfig_anaconda} && \
%endif %endif
%changelog %changelog
* Thu Nov 21 2024 Solar Designer <solar@openwall.com> 8.7p1-43.el9_5.security.0.10
- Rebase on 8.7p1-43
* Wed Jul 17 2024 Solar Designer <solar@openwall.com> 8.7p1-38.4.el9_4.security.0.9 * Wed Jul 17 2024 Solar Designer <solar@openwall.com> 8.7p1-38.4.el9_4.security.0.9
- Patch the code to silently ignore GSSAPIKeyExchange when unsupported - Patch the code to silently ignore GSSAPIKeyExchange when unsupported
...@@ -847,19 +858,27 @@ test -f %{sysconfig_anaconda} && \ ...@@ -847,19 +858,27 @@ test -f %{sysconfig_anaconda} && \
child process to avoid polluting actual sshd's address space with that child process to avoid polluting actual sshd's address space with that
library and its many dependencies (shortens "ldd sshd" from 28 to 20 lines) library and its many dependencies (shortens "ldd sshd" from 28 to 20 lines)
* Wed Jul 03 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-38.4 * Tue Jul 09 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-43
- rebuilt
* Wed Jul 03 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-38.3
- rebuilt
* Mon Jul 01 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-38.2
- Possible remote code execution due to a race condition (CVE-2024-6409) - Possible remote code execution due to a race condition (CVE-2024-6409)
Resolves: RHEL-45740 Resolves: RHEL-45741
* Fri Jun 28 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-38.1 * Thu Jul 04 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-42
- Possible remote code execution due to a race condition (CVE-2024-6387) - Possible remote code execution due to a race condition (CVE-2024-6387)
Resolves: RHEL-45347 Resolves: RHEL-45348
* Mon Jun 03 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-41
- Fix ssh multiplexing connect timeout processing
Resolves: RHEL-37748
* Thu May 02 2024 Zoltan Fridrich <zfridric@redhat.com> - 8.7p1-40
- Correctly audit hostname and IP address
Resolves: RHEL-22316
- Make default key sizes configurable in sshd-keygen
Resolves: RHEL-26454
* Wed Apr 24 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-39
- Use FIPS-compatible API for key derivation
Resolves: RHEL-32809
* Fri Jan 05 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-38 * Fri Jan 05 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-38
- Fix Terrapin attack - Fix Terrapin attack
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment