Bug#859655: [pkg-go] Bug#859655: golang-go.crypto: CVE-2017-3204

2017-04-15 Thread Antoine Beaupré
On 2017-04-15 11:04:31, Vincent Bernat wrote: > ❦ 14 avril 2017 15:07 -0400, anarcat  : > >> I looked into this during the Montreal BSP, and it's unclear what we >> should do here, considering there has been multiple new uploads since >> the stretch freeze. >> >> The patch is pretty long: >> >> h

Bug#859655: [pkg-go] Bug#859655: golang-go.crypto: CVE-2017-3204

2017-04-15 Thread Vincent Bernat
❦ 14 avril 2017 15:07 -0400, anarcat  : > I looked into this during the Montreal BSP, and it's unclear what we > should do here, considering there has been multiple new uploads since > the stretch freeze. > > The patch is pretty long: > > https://github.com/golang/crypto/commit/e4e2799dd7aab89f5

Bug#859655: golang-go.crypto: CVE-2017-3204

2017-04-14 Thread anarcat
Control: user -1 debian-rele...@lists.debian.org Control: usertags -1 bsp-2017-04-ca-montreal Control: tags -1 +patch I looked into this during the Montreal BSP, and it's unclear what we should do here, considering there has been multiple new uploads since the stretch freeze. The patch is pretty

Bug#859655: golang-go.crypto: CVE-2017-3204

2017-04-05 Thread Salvatore Bonaccorso
Source: golang-go.crypto Version: 1:0.0~git20161012.0.5f31782-1 Severity: grave Tags: upstream patch security Forwarded: https://github.com/golang/go/issues/19767 Hi, the following vulnerability was published for golang-go.crypto. CVE-2017-3204[0]: | The Go SSH library (x/crypto/ssh) by default